Cisco Secure Firewall Adaptive Security Appliance (ASA) Software va Secure Firewall Threat Defense (FTD) Software'dagi yuqori darajadagi xavfsizlik zaifligini tuzatish uchun yamoqlarni e'lon qildi. Kompaniya ma'lum qilishicha, bu zaiflik yovvoyi muhitda (in the wild) ekspluatatsiya qilinmoqda.
CVE-2026-76418 raqami bilan kuzatiladigan bu zaiflik CVSS baholash tizimida 8,6 ballga baholangan. Muvaffaqiyatli ekspluatatsiya natijasida autentifikatsiyadan o'tmagan, masofaviy hujumchi qurilmani kutilmaganda qayta yuklashga majbur qilishi mumkin, bu esa xizmatdan foydalanishni rad etish (DoS) holatiga olib keladi.
Cisco ma'lumotiga ko'ra, muammo ASA va FTD dasturiy ta'minotining Remote Access SSL VPN xizmatida joylashgan.
"Bu zaiflik tunnel guruhida ikkilamchi autentifikatsiya sozlanganda yuzaga keladigan mantiqiy xatolarga bog'liq," — deb aytilgan chorshanba kungi maslahatda. "Hujumchi SSL masofaviy kirish VPN'iga ulanishda maxsus tayyorlangan so'rov yuborish orqali bu zaiflikni ekspluatatsiya qilishi mumkin. Muvaffaqiyatli ekspluatatsiya hujumchiga ta'sirlangan qurilmani qayta yuklashga imkon beradi, natijada DoS holati yuzaga keladi."
Tarmoq uskunalari ishlab chiqaruvchisi 2026-yil oktyabr oyida bu zaiflikning faol ekspluatatsiya qilinishi haqida xabardor bo'lganini aytdi, ammo hujumlar qachon boshlanganligi, ularning ortida kim turganligi va harakatlar ko'lami haqida hech qanday tafsilotlarni oshkor qilmadi.
Zaiflikni tuzatish uchun quyidagi versiyalar mavjud —
- Cisco Secure Firewall ASA Software Release
- 9.16 va undan oldingi — 9.16.4.104 da tuzatilgan
- 9.18 — 9.18.4.96 da tuzatilgan
- 9.20 — 9.20.4.50 da tuzatilgan
- 9.22 — 9.22.3.200 da tuzatilgan
- 9.23 — 9.23.1.48 da tuzatilgan
- 9.24 — 9.24.1.27 va 9.24.10.1 da tuzatilgan
- Cisco Secure FTD Software Release
- 7.0 va undan oldingi — 7.0.11 da tuzatilgan
- 7.2 — 7.2.13 da tuzatilgan
- 7.4 — 7.4.9 da tuzatilgan
- 7.6 — 7.6.7 da tuzatilgan
- 7.7 — 7.7.14 da tuzatilgan
- 10.0 — 10.0.3 da tuzatilgan
- 10.1 — 10.1.1 da tuzatilgan
Cisco shuningdek, quyidagi shartlar bajarilganda zaiflik Cisco qurilmalariga ta'sir qilishini ta'kidladi —
- Ular Cisco Secure Firewall ASA Software yoki Cisco Secure FTD Software'ning zaif versiyasini ishlatayotgan bo'lishi kerak.
- SSL masofaviy kirish VPN kirish xizmati yetib borish mumkin bo'lishi kerak.
- Tunnel guruh doirasida ikkilamchi autentifikatsiya sozlangan bo'lishi kerak.
"Agar tunnel-group-list enable sozlangan bo'lsa, barcha tunnel guruhlarini, shu jumladan standart tunnel guruhi DefaultWEBVPNGroup ni, secondary-authentication-server-group uchun tekshiring," — deb aytgan Cisco.
"Agar tunnel-group-list enable mavjud bo'lmasa yoki no tunnel-group-list enable buyrug'i yordamida o'chirilgan bo'lsa, standart tunnel guruhi DefaultWEBVPNGroup ni secondary-authentication-server-group uchun tekshiring, chunki guruh ro'yxatini o'chirish, agar ushbu standart guruh ikkilamchi autentifikatsiyadan foydalansa, ta'sirni bartaraf etmaydi."
Vaqtinchalik yumshatish chorasi sifatida kompaniya mijozlarga, agar DefaultWEBVPNGroup ikkilamchi autentifikatsiyadan foydalanmasa, tunnel guruh ro'yxatini o'chirishni, yoki har qanday foydalanuvchi tomonidan sozlangan tunnel guruh ro'yxatida yoki standart tunnel guruhi DefaultWEBVPNGroup'da ikkilamchi autentifikatsiyani o'chirishni tavsiya qilmoqda.
"Cisco Secure FTD Software'da, Cisco Secure FMC Software yoki Cisco Secure FDM'da joylashtirilgan masofaviy kirish VPN siyosatini va natijada qurilmaning ishlaydigan konfiguratsiyasini ko'rib chiqing," — deb aytgan Cisco. "Ta'sirlangan ishlov berish yo'liga yetib borish uchun muvaffaqiyatli VPN kirishi shart emas."
Bu e'lon Cisco'ning UAT-11473 deb kuzatiladigan murakkab ilg'or doimiy tahdid (APT) aktyori Cisco SD-WAN Catalyst Controller nusxalaridagi autentifikatsiyani chetlab o'tish zaifligi CVE-2026-20127 ni qurol sifatida ishlatib, autentifikatsiyani chetlab o'tgan va ta'sirlangan tizimlarga ruxsatsiz kirish olganini oshkor qilishi bilan bir vaqtda sodir bo'ldi.
Kosmik va sun'iy yo'ldosh xizmatlari, mudofaa va aerokosmik texnologiyalar, shuningdek siyosiy tadqiqotlar sohalariga qaratilgan bu faoliyat Volt Typhoon'ning Silent Train yashirin tarmog'i bilan infratuzilma o'xshashliklariga ega deb baholangan.
"UAT-11473 keyinchalik biz 'KeyDrift' deb kuzatadigan maxsus zararli dasturiy ta'minot tizimini o'rnatdi. Bu tizim bir nechta komponentlardan [masalan, PolyFlame va LittleFilch] iborat bo'lib, maxfiy kalit ma'lumotlarini yig'ish, orqa eshiklar sifatida ishlash va oraliq buyruq va nazorat (C2) xostlari vazifasini bajarishga qaratilgan," — deb aytgan Cisco Talos.
"Bu tizim uzoq muddatli doimiy kirish va maxfiy kalit materialining avtomatlashtirilgan eksfiltratsiyasini ta'minlash uchun mo'ljallangan. KeyDrift SD-WAN nazorat tekisligi jarayonlari ichida ishlaydi va shifrlangan nazorat trafikini ushlab qolish, nazorat sessiyasi metama'lumotlari va ma'lumot tekisligi kalit materialini ajratib olish, shuningdek yig'ilgan materialni shifrlangan yozuvlar yordamida tayyorlash yoki uzatish qobiliyatiga ega."
Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild.
The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS scoring system. Successful exploitation could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition.
According to Cisco, the issue is rooted in the Remote Access SSL VPN service of ASA and FTD software.
"This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group," it said in a Wednesday advisory. "An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition."
The network equipment major said it became aware of active exploitation of this vulnerability in October 2026, but did not share any specifics as to when the attacks began, who is behind them, and the scale of the efforts.
Fixes for the flaw are available in the following versions -
- Cisco Secure Firewall ASA Software Release
- 9.16 and earlier - Fixed in 9.16.4.104
- 9.18 - Fixed in 9.18.4.96
- 9.20 - Fixed in 9.20.4.50
- 9.22 - Fixed in 9.22.3.200
- 9.23 - Fixed in 9.23.1.48
- 9.24 - Fixed in 9.24.1.27 and 9.24.10.1
- Cisco Secure FTD Software Release
- 7.0 and earlier - Fixed in 7.0.11
- 7.2 - Fixed in 7.2.13
- 7.4 - Fixed in 7.4.9
- 7.6 - Fixed in 7.6.7
- 7.7 - Fixed in 7.7.14
- 10.0 - Fixed in 10.0.3
- 10.1 - Fixed in 10.1.1
Cisco also noted that the vulnerability affects Cisco devices if the following conditions are met -
- They are running a vulnerable release of Cisco Secure Firewall ASA Software or Cisco Secure FTD Software.
- The SSL remote access VPN login service is reachable.
- Secondary authentication is configured in the tunnel group scope.
"If tunnel-group-list enable is configured, check all tunnel groups, including the default tunnel group, DefaultWEBVPNGroup, for secondary-authentication-server-group," Cisco said.
"If tunnel-group-list enable is absent or has been removed using the no tunnel-group-list enable command, check the default tunnel group, DefaultWEBVPNGroup, for secondary-authentication-server-group because disabling the group list does not remove exposure when that default group uses secondary authentication."
As a temporary mitigation, the company is recommending that customers turn off the tunnel group list if DefaultWEBVPNGroup does not use secondary authentication, or disable secondary authentication on any user-configured tunnel group list or on the default tunnel group, DefaultWEBVPNGroup.
"On Cisco Secure FTD Software, review the deployed remote access VPN policy and the resulting device running configuration in Cisco Secure FMC Software or Cisco Secure FDM," Cisco said. "A successful VPN login is not required to reach the affected processing path."
The disclosure comes as Cisco revealed that a sophisticated advanced persistent threat (APT) actor tracked as UAT-11473 weaponized CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances, to bypass authentication and gain unauthorized access to affected systems.
The activity, which has targeted space and satellite services, defense and aerospace technology, and policy research sectors, is assessed to share infrastructure overlaps with Volt Typhoon's Silent Train covert network.
"UAT-11473 then installed a custom malware framework we track as 'KeyDrift' consisting of multiple components [like PolyFlame and LittleFilch] geared towards collecting sensitive keying information, acting as backdoors and intermediate command-and-control (C2) hosts," Cisco Talos said.
"The framework is designed to provide long-term persistent access and automated exfiltration of sensitive keying material. KeyDrift operates inside SD-WAN control-plane processes and is capable of intercepting decrypted control traffic, extracting control-session metadata and data-plane keying material, and staging or transmitting the collected material using encrypted records."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.