Cisco Adaptive Security Appliance (ASA) va Threat Defense (FTD) dasturiy ta'minotidagi rad etish (denial-of-service) nol-kun zaifligini tuzatish uchun xavfsizlik yangilanishlarini e'lon qildi. Hujumchilar bu zaiflikdan foydalanib, zaif firewall qurilmalarini masofadan ishdan chiqarishmoqda.
CVE-2026-76418 sifatida kuzatilgan bu yuqori darajadagi zaiflik, konfiguratsiyasida 'webvpn' kalit so'zi bo'lgan va kamida bitta interfeysda SSL VPN yoqilgan ASA va FTD dasturiy ta'minotini ishlatayotgan qurilmalarga ta'sir qiladi.
Muvaffaqiyatli ekspluatatsiya autentifikatsiyasiz, masofadan hujumchilarga rad etish (DoS) holatini keltirib chiqarish imkonini beradi, bu esa qurilmaning kutilmaganda qayta yuklanishiga olib keladi.
Cisco mijozlarga zaif firewall'larni yangilashni tavsiya qildi, chunki uning Mahsulot xavfsizligi hodisalariga javob berish jamoasi (PSIRT) bu oy boshida zaiflikning yovvoyi tabiatda ekspluatatsiya qilinayotganiga dalil topdi. Biroq, kompaniya buzilish ko'rsatkichlarini taqdim etmadi va hujumlar haqida qo'shimcha ma'lumot, jumladan, qaysi tashkilotlar nishonga olingani yoki zaiflikni kim ekspluatatsiya qilayotgani haqida ma'lumot bermadi.
"Bu zaiflik tunnel guruhida ikkilamchi autentifikatsiya sozlanganda yuzaga keladigan mantiqiy xatolarga bog'liq. Hujumchi SSL masofaviy kirish VPN'iga ulanishda maxsus tayyorlangan so'rov yuborish orqali bu zaiflikdan foydalanishi mumkin. Muvaffaqiyatli ekspluatatsiya ta'sirlangan qurilmaning qayta yuklanishiga olib kelishi mumkin, natijada DoS holati yuzaga keladi," deb aytdi Cisco.
"2026-yil oktyabr oyida Cisco PSIRT bu zaiflikning faol ekspluatatsiya qilinayotganidan xabardor bo'ldi. Cisco mijozlarga bu zaiflikni bartaraf etish uchun tuzatilgan dasturiy ta'minot versiyasiga yangilashni qat'iy tavsiya qiladi."
Cisco bu xavfsizlik muammosini bartaraf etadigan hech qanday vaqtinchalik yechim taqdim etmagan bo'lsa-da, CVE-2026-76418 ni darhol tuzata olmaydigan administratorlar uni DefaultWEBVPNGroup tunnel guruhidagi yoki har qanday foydalanuvchi sozlagan tunnel guruh ro'yxatidagi ikkilamchi autentifikatsiyani o'chirish orqali yumshatishi mumkin.
Hozirda Shadowserver internet monitoring platformasi onlayn tarzda ochiq bo'lgan 51 000 dan ortiq Cisco ASA SSL VPN qurilmalarini kuzatmoqda, lekin ularning qanchasi allaqachon himoyalangani yoki honeypot ekanligi haqida ma'lumot bermaydi.
Internetda ochiq Cisco ASA SSL VPN qurilmalari (Shadowserver)
O'tgan yili Cisco sentyabr oyida ASA va FTD firewall qurilmalariga ta'sir qiladigan yana ikkita zaiflikni (CVE-2025-20362 va CVE-2025-20333) tuzatdi va mijozlarga hujumchilarning ularni VPN veb-xizmatlari yoqilgan 5500-X Series qurilmalariga nol-kun hujumlarida ekspluatatsiya qilganini ogohlantirdi.
Shu kuni AQSh Kiberxavfsizlik va infratuzilma xavfsizligi agentligi (CISA) 25-03-sonli Favqulodda direktivani e'lon qilib, federal agentliklarga Cisco firewall qurilmalarini 24 soat ichida himoyalashni buyurdi.
Cisco hujumlarni ArcaneDoor kampaniyasiga bog'ladi, bu kampaniya 2023-yil noyabr oyidan beri hukumat tarmoqlariga kirish uchun yana ikkita nol-kun zaifligini (CVE-2024-20353 va CVE-2024-20359) ekspluatatsiya qilgan.
Yaqinda, avgust oyida Cisco hujumchilar yovvoyi tabiatda faol ekspluatatsiya qilayotgan yana bir rad etish nol-kun zaifligini (CVE-2026-20349) tuzatdi, bu zaiflik SSL listen sockets yoqilgan ASA va FTD firewall qurilmalarini ishdan chiqarish imkonini beradi.
Shu oy boshida u mijozlarga faol ekspluatatsiya qilinayotgan nol-kun zaifligi (CVE-2026-76519) haqida ogohlantirdi, bu zaiflik uning Secure Email Gateway (SEG) xavfsizlik yechimida autentifikatsiyasiz hujumchilarga root huquqlari bilan masofadan buyruqlarni bajarish imkonini beradi.
2021-yil noyabr oyidan beri CISA 101 ta Cisco xavfsizlik zaifligini yovvoyi tabiatda ekspluatatsiya qilingan deb belgilagan, ulardan yettitasi ransomware to'dalari tomonidan ham suiiste'mol qilingan.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37 foizi bloklanadi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda, oldini olish keskin pasayadi.
Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika bo'yicha mudofaa choralarini o'lchaydi.
Hisobotni oling
Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices.
Tracked as CVE-2026-76418, this high-severity vulnerability affects devices running ASA and FTD software with configurations containing the 'webvpn' keyword and SSL VPN enabled on at least one interface.
Successful exploitation allows unauthenticated, remote attackers to trigger a denial-of-service (DoS) condition, causing the device to reload unexpectedly.
Cisco advised customers to patch vulnerable firewalls after its Product Security Incident Response Team (PSIRT) discovered evidence that the flaw was being exploited in the wild earlier this month. However, the company didn't provide indicators of compromise and hasn't shared additional information about the attacks, including which organizations are being targeted or who is exploiting the flaw.
"This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition," Cisco said.
"In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability."
While Cisco provided no workarounds that address this security issue, admins who can't immediately patch CVE-2026-76418 can mitigate it by disabling secondary authentication on the default DefaultWEBVPNGroup tunnel group or on any user-configured tunnel group list.
Currently, Internet monitoring platform Shadowserver tracks more than 51,000 Cisco ASA SSL VPN devices exposed online, but doesn't provide information on how many have already been secured or are honeypots.
Internet-exposed Cisco ASA SSL VPN devices (Shadowserver)
Last year, Cisco patched two other flaws (CVE-2025-20362 and CVE-2025-20333) affecting ASA and FTD firewall devices in September and cautioned customers that attackers had exploited them in zero-day attacks targeting 5500-X Series devices with VPN web services enabled.
The same day, the US Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 25-03, ordering federal agencies to secure their Cisco firewall devices within 24 hours.
Cisco linked the attacks to the ArcaneDoor campaign, which had also been exploiting two other zero-days (CVE-2024-20353 and CVE-2024-20359) to breach government networks since November 2023.
More recently, in August, Cisco addressed another denial-of-service zero-day vulnerability (CVE-2026-20349) that attackers were actively exploiting in the wild to crash affected ASA and FTD firewall devices with SSL listen sockets enabled.
Earlier this month, it also warned customers to patch an actively exploited zero-day (CVE-2026-76519) in its Secure Email Gateway (SEG) security solution that lets unauthenticated attackers execute commands remotely with root privileges.
Since November 2021, CISA has flagged 101 Cisco security flaws as exploited in the wild, seven of which were also abused by ransomware gangs.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report