A Critically Exploitable Flaw Requiring No Authentication

On October 29, 2026, Cisco announced it had patched a critical vulnerability (CVE-2026-76418) in its Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software, specifically affecting the Remote Access SSL VPN service. According to Cisco, this vulnerability allows an unauthenticated attacker to send malicious VPN requests and force unintended device reboots, resulting in a denial of service (DoS).

The flaw stems from logical errors in secondary authentication configuration for VPN tunnel groups, as Cisco explains: "A successful attack does not even require a valid VPN connection to reach the vulnerable processing path." The CERT-FR classifies this vulnerability under the CWE-690 category (unverified NULL pointer dereference), confirming its destructive potential.

A successful attack does not even require a valid VPN connection to reach the vulnerable processing path

Confirmed Active Exploitation and Targeted Groups

Cisco confirmed that this flaw was actively exploited in October 2026, though the company did not disclose the attackers' identities or the scale of the targets. The UAT-11473 group has also been linked to this campaign, exploiting another vulnerability (CVE-2026-20127) to bypass authentication on Cisco SD-WAN Catalyst Controller systems, according to The Hacker News. This group targeted sectors such as space, defense, and public policy, with overlaps in activities linked to the Volt Typhoon group.

The attacks involve the use of the KeyDrift framework, which collects encryption materials and acts as a backdoor in SD-WAN processes, enabling persistent access to infrastructures.

Patches and Temporary Mitigations

Cisco has released patches for various versions of its ASA/FTD software, such as version 9.16.4.104 for ASA 9.16. Affected versions include all devices with an accessible SSL VPN and secondary authentication configured. Until updates are applied, Cisco recommends temporary measures:

• disable the tunnel-group list (tunnel-group-list enable)
• or disable secondary authentication for all tunnel groups, including the default group (DefaultWEBVPNGroup)

The CISA (Cybersecurity and Infrastructure Security Agency) has logged the vulnerability with an exploitation status marked as "none", but with a technical impact rated as "partial", highlighting its potential for disruption.

What this changes here

For businesses and administrations in West Africa, particularly in Benin, where Cisco ASA/FTD solutions are commonly deployed to secure remote access and critical infrastructures, this vulnerability poses a major risk. If exposed firewalls subjected to malicious VPN attacks were forced to restart, this could paralyze essential services, such as government platforms, banking networks, or connected healthcare systems.

Organizations using configurations with secondary authentication on VPN tunnel groups should prioritize applying Cisco patches or implementing temporary mitigations to avoid disruptions. Additionally, the presence of groups like UAT-11473 targeting strategic sectors underscores the need to monitor suspicious activities on SD-WAN systems, often used to interconnect remote sites.

Finally, this vulnerability highlights the importance of regularly updating security firmware and software, a practice still underestimated in some African administrations where resources dedicated to cybersecurity remain limited.