New Cisco firewall zero-day exploited to crash SSL VPN devices
Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices.
Excerpt from the primary source: BleepingComputer
Who is affected
Enterprises · Security professionals
Affected technology: Cisco networking & security
Why it matters
Source reporting says attackers are already exploiting this, so exposed Cisco networking & security systems are at immediate risk.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Act now
Treat this as an emergency. Identify every system running Cisco networking & security, apply the vendor's fix or published mitigations immediately, and check for signs of compromise. Patching alone does not remove an attacker who already got in.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Original reporting
Related
NIK C2: The new AI-enabled command-and-control framework
Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.”
Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
Cisco on Wednesday released fixes for an exploited vulnerability affecting its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Tracked as CVE-2026-76418 and assigned a CVSS score of 8.6, the bug resides in the Remote Access SSL VPN service. Attackers can exploit it remotely, without authenticating, to force the device […]…
Source reporting says attackers are already exploiting this, so exposed Cisco networking & security systems are at immediate risk.
Treat this as an emergency.
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affected systems to deploy KeyDrift.
CISA lists this as exploited in the wild. Unpatched Cisco networking & security and Catalyst SD-WAN Controller and Manager systems are exposed to active attacks now.
Treat this as an emergency.
Cisco Patches 34 Vulnerabilities Across Multiple Products
Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks.
Apply the vendor's security update for Cisco networking & security.