Cisco has patched a flaw in its business firewalls that attackers are already using to knock them offline. Companies with remote VPN access should check now.
Attackers are crashing Cisco business firewalls from the internet, and Cisco has released a fix. The flaw sits in the software that runs Cisco's ASA and Secure Firewall Threat Defense (FTD) devices. These are the boxes many companies use to guard their networks and let staff connect from home. The flaw is tracked as CVE-2026-76418 and rated high severity.
Cisco says its security response team learned in October 2026 that the flaw was being used in real attacks. That makes it a zero-day, meaning attackers found it before a fix existed. An attacker does not need a password. They send a specially crafted request to the device's remote access VPN, and the device restarts. Cisco calls this a denial-of-service condition. In plain terms, the firewall stops doing its job.
Not every Cisco firewall is exposed. The device must have the SSL VPN feature turned on for at least one connection point, and its settings must include the 'webvpn' keyword. SSL VPN is the remote access feature that lets employees log in from outside the office.
If your business does not use Cisco ASA or FTD firewalls, or does not use remote VPN on them, this flaw does not apply. Shadowserver, a group that monitors the internet, tracks more than 51,000 Cisco ASA SSL VPN devices exposed online. It cannot say how many are already patched, or how many are honeypots, which are decoy systems set up to study attackers.
The steps are in the alert box above. The short version: find out whether your company runs an affected Cisco firewall, and get the fixed software installed. Cisco strongly recommends upgrading. It offers no true workaround, but it does describe a temporary mitigation for teams that cannot patch right away.
This is part of a pattern. In August, Cisco fixed another actively exploited denial-of-service zero-day in the same firewall family. Earlier this month, it also warned about an exploited flaw in its Secure Email Gateway. Last year, two other firewall flaws were used in attacks that Cisco tied to a campaign called ArcaneDoor. Since November 2021, the US cybersecurity agency CISA has flagged 101 Cisco flaws as exploited, seven of them also used by ransomware gangs.
Cisco has not said who is behind the attacks or which organizations were hit. It has not published indicators of compromise, the technical clues that help teams spot a break-in. For now, the known effect is crashes and lost VPN access, so a firewall that restarts without explanation is worth reporting to IT right away.
If your company uses a Cisco firewall with remote VPN, ask IT today whether the fixed software is installed.
Morristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
