How the Attack Works (in 4 simple steps)
Think of your Cisco firewall as the front door and security guard of your office network. The SSL VPN is the side entrance remote staff use. This bug lets a stranger walk up to that side entrance, hand the guard a strangely-filled form, and the guard faints — taking the front door down with him.
Attackers scan the internet for Cisco VPN login pages
Automated scanners find exposed Cisco SSL VPN portals within minutes. Your VPN page is public by design — that’s how remote staff reach it — so it is easy to locate.
They send one specially crafted connection request
No username, no password. When secondary authentication is configured on a tunnel group, a logic error means the firewall doesn’t properly check a return value — a classic NULL pointer dereference (CWE-690).
The firewall crashes and reboots
During the reload, everything behind the firewall loses connectivity: internet, site-to-site VPNs, cloud apps, VoIP phones, and card terminals. A reboot can take several minutes.
They do it again… and again
Because it takes one request, attackers can keep your firewall in a crash loop. Disruptive outages like this are also used as a smokescreen while other attacks run in the background.
Am I Affected? Answer 3 Questions
A device is vulnerable only if all three conditions are true. Not sure? Ask your IT provider — or let us check for you.
1.Do you run Cisco Secure Firewall ASA (9.16 – 9.24) or FTD (7.0 – 10.1) software?
Usually a Cisco ASA 5500-X, Firepower 1000/2100/3100/4100 or Secure Firewall appliance.
2.Is the SSL / AnyConnect remote access VPN turned on and reachable from the internet?
If staff connect to the office using Cisco AnyConnect or Cisco Secure Client — yes.
3.Is secondary authentication configured on a tunnel group (including DefaultWEBVPNGroup)?
Common when you use two login steps, e.g. AD password + RADIUS/MFA token or certificate.
According to Cisco, Secure Firewall Management Center (FMC), Cisco Secure Access, and cloud-delivered firewalls are not affected.
“It’s Just a Reboot” — The Real Cost of a Crash
Use the sliders to estimate what a firewall crash loop costs your business. When the firewall goes down, every connected employee, phone, and payment terminal stops with it.
Estimated cost of this incident
$0
Excludes overtime, SLA penalties & reputational damage.
The Fix, Step by Step
Find every Cisco firewall you own
Include branch offices, warehouses, DR sites and that “temporary” ASA in the server closet. Record model, software version (show version) and whether AnyConnect/SSL VPN is enabled.
Check your version against Cisco’s fixed releases
Compare with the table below and confirm on Cisco’s official security advisory for CVE-2026-76418 before you upgrade — Cisco occasionally revises fixed builds.
Schedule an emergency change window
Plan for a reboot. If you run a high-availability pair, upgrade the standby unit first, fail over, then upgrade the other — near-zero downtime.
Upgrade & verify
Back up the running config, apply the fixed image, and confirm VPN users can log in with full secondary authentication.
Watch for crash signs
Look for unexpected reloads, crashinfo files, and spikes of failed SSL VPN connections from unfamiliar IPs. These are indicators someone already tried.
| Train | Upgrade to |
|---|---|
| 9.16 | 9.16.4.104 |
| 9.18 | 9.18.4.96 |
| 9.20 | 9.20.4.50 |
| 9.22 | 9.22.3.200 |
| 9.23 | 9.23.1.48 |
| 9.24 | 9.24.1.27 / 9.24.10.1 |
| Train | Upgrade to |
|---|---|
| 7.0 | 7.0.11 |
| 7.2 | 7.2.13 |
| 7.4 | 7.4.9 |
| 7.6 | 7.6.7 |
| 7.7 | 7.7.14 |
| 10.0 | 10.0.3 |
| 10.1 | 10.1.1 |
Versions as published in public reporting at time of writing. Always confirm against Cisco’s official advisory and the Cisco Software Checker before upgrading.
Can’t patch tonight? Temporary workaround
Cisco’s interim mitigation is to remove secondary authentication from affected tunnel groups (including DefaultWEBVPNGroup). This stops the crash — but it also weakens VPN login security. Treat it as a stop-gap of hours or days, not weeks, and pair it with tighter monitoring.
How QueryTel Keeps You Online
Most Canadian businesses don’t have a firewall engineer on call at 2 a.m. That’s exactly the gap QueryTel fills — remotely and physically.
Exposure scan within hours
We inventory your Cisco estate, check versions and VPN configuration, and tell you plainly whether you’re exposed — usually the same day.
Learn moreManaged emergency patching
Our 24/7 Canadian NOC plans and executes the upgrade — HA-aware, with config backups and rollback — during a window that suits your operations.
Learn more24/7 SOC monitoring
SOC 24 watches firewall logs for reload events, crash dumps and abnormal VPN traffic, and escalates the moment something looks wrong.
Learn moreOn-site smart hands in under 60 min*
If a unit won’t come back, a QueryTel field engineer arrives in the GTA, Vancouver, Calgary or Edmonton with replacement hardware and a pre-staged config.
Learn more*Target response in major metro service areas; coverage across Canada.
A 2 a.m. crash: with and without a managed partner
On your own
- 02:00Firewall reloads. Nobody notices.
- 07:30First staff arrive — no internet, no phones.
- 09:00Searching for the admin password and Cisco contract.
- 14:00+Still waiting on a fix or replacement unit.
With QueryTel
- 02:00Reload detected — NOC alert fires.
- 02:05Engineer confirms attack pattern, applies mitigation.
- 03:00Emergency patch completed on HA pair.
- 07:30Staff arrive. Everything just works. Report in inbox.
Your Weekend Checklist
Frequently Asked Questions
Can attackers steal data with this bug?
Based on Cisco’s disclosure, the flaw causes the firewall to crash and reload (denial of service). It isn’t described as a data-theft or remote-code-execution bug. But repeated crashes can take your whole office offline, and outages are often used as a distraction during wider attacks.
Do attackers need a password?
No. The attack is unauthenticated — anyone who can reach your SSL VPN login page over the internet can send the malicious request.
We use Fortinet / Palo Alto / Meraki. Are we affected?
Not by this specific CVE — it affects Cisco ASA and FTD software only. That said, every major firewall vendor has had VPN vulnerabilities in recent years, so continuous patch management matters regardless of brand.
Is Cisco FMC or cloud-delivered firewall affected?
According to Cisco, Secure Firewall Management Center, Cisco Secure Access and cloud-delivered firewalls are not affected.
What if I can’t patch tonight?
Remove secondary authentication from affected tunnel groups as an interim mitigation, increase monitoring, and schedule the upgrade as soon as possible. The workaround reduces login security, so don’t leave it in place long-term.
Not sure if you’re exposed? We’ll tell you today.
QueryTel engineers will review your Cisco firewall versions and VPN configuration, and give you a clear yes/no — plus a patch plan if you need one. No obligation.
Was this guide helpful?
Help us keep our security alerts clear and useful for Canadian IT leaders.