Zaifliklar
Avgustdan beri ikkinchi Cisco Firewall VPN nol-kun zaifligi hujumchilari tomonidan ekspluatatsiya qilinmoqda
Muallif: Eduard Kovacs | 29-oktabr 2026 (ET 5:47)
Cisco chorshanba kuni Secure Firewall Adaptive Security Appliance (ASA) va Secure Firewall Threat Defense (FTD) dasturiy ta'minotiga ta'sir qiluvchi ekspluatatsiya qilingan zaiflik uchun tuzatishlarni e'lon qildi.
CVE-2026-76418 sifatida kuzatilgan va CVSS balli 8,6 berilgan xato Remote Access SSL VPN xizmatida joylashgan. Hujumchilar uni masofadan turib, autentifikatsiyasiz ekspluatatsiya qilib, qurilmani kutilmaganda qayta ishga tushirishga majbur qilishlari va uning mavjudligini buzishlari mumkin.
Cisco muammoni ikkilamchi autentifikatsiya bilan sozlangan tunnel guruhlariga ta'sir qiluvchi mantiqiy xatolar bilan bog'laydi. Ekspluatatsiya SSL VPN ga ulanish paytida yuborilgan zararli so'rovni o'z ichiga oladi.
«Muvaffaqiyatli VPN kirishi ta'sirlangan qayta ishlash yo'liga yetish uchun talab qilinmaydi», — deb ta'kidladi Cisco.
Hujum ishlashi uchun firewall tuzatilmagan relizda ishlashi, SSL VPN kirish xizmati yetarli bo'lishi va ta'sirlangan tunnel guruhida ikkilamchi autentifikatsiyadan foydalanishi kerak. Kompaniyaning bulut orqali yetkaziladigan firewall va boshqaruv takliflari, Secure Access va Secure Firewall Management Center zaif emas.
Cisco mahsulot xavfsizligi jamoasi oktyabr oyida xato yovvoyi tabiatda ekspluatatsiya qilinayotganini bilib oldi. Hujumlar yoki ularning ortida turgan tahdid aktorlari haqida hech qanday ma'lumot e'lon qilinmadi.
Reklama. O'qishni davom ettirish uchun pastga aylantiring.
Zaiflik Cisco TAC qo'llab-quvvatlash holati davomida aniqlangan va kompaniya uni topishda Erik Fernaldni e'tirof etdi.
Hech qanday vaqtinchalik yechimlar mavjud emas. Standart tunnel guruhining sozlamalariga qarab, mijozlar tunnel guruh ro'yxatini o'chirish yoki ikkilamchi autentifikatsiyani olib tashlash orqali o'z ta'sirini kamaytirishlari mumkin. Cisco ikkilamchi autentifikatsiyani olib tashlash masofaviy kirish VPN ni kamroq xavfsiz qilishini ogohlantiradi va yangilashni tavsiya qiladi.
Bu so'nggi oylarda DoS hujumlari uchun ekspluatatsiya qilingan ikkinchi ASA va FTD nol-kun zaifligi. Avgust oyida Cisco CVE-2026-20349, HTTP so'rovlarini qayta ishlash xatosi uchun tuzatishlarni e'lon qildi, bu ham autentifikatsiyasiz hujumchilarga Remote Access SSL VPN xizmati orqali masofadan turib qayta yuklashni keltirib chiqarish imkonini beradi.
Cisco o'sha hujumlar haqida ham tafsilotlarni oshkor qilmadi. Ikkala xato ham bir xil tahdid aktori tomonidan ekspluatatsiya qilinganmi, noma'lum.
Bog'liq: Xitoylik xakerlar past darajali ESXi jurnal xatosini nol-kun sifatida jimgina ishlatishdi
Bog'liq: Xakerlar yangi Oracle EBS zaifligini tekshirishni boshlashdi
Bog'liq: Xitoy bilan bog'liq xakerlar PHP2Shell orqali firewallarni ildizdan olishmoqda
Yozgan: Eduard Kovacs
Eduard Kovacs (@EduardKovacs) SecurityWeek ning katta boshqaruv muharriri. U jurnalistika sohasida 2011-yilda o'rta maktab IT o'qituvchisi sifatida ishlaganidan so'ng boshlagan. Eduard sanoat informatikasi bo'yicha bakalavr darajasiga va elektr muhandisligida qo'llaniladigan kompyuter texnikasi bo'yicha magistr darajasiga ega.
Kundalik axborot byulleteni
So'nggi kiberxavfsizlik tahdidlari, tendentsiyalar va mutaxassis fikrlari haqida xabardor bo'lish uchun SecurityWeek elektron pochta axborotiga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik siyosatimizni o'qing.
Eduard Kovacsdan ko'proq
- CISA Node2Shell ekspluatatsiyasidan ogohlantiradi, chunki Honeypotlar hujum urinishlarini qayd etmoqda
- Tailscale «Tailworm» zaifliklarining muvofiqlashtirilmagan oshkor qilinishidan so'ng tezda tuzatishlarni e'lon qildi
- iOS, macOS 27.2 286 xatoni tuzatdi; ekspluatatsiya qilingan xato iOS 18 ga qayta portlandi
- Dengiz koalitsiyasi kema va port tizimlari uchun bepul zaiflik ma'lumotlar bazasini ishga tushirdi
- Sanoat sotuvchilari PHP2Shell zaifliklari uchun mahsulotlarini tekshirmoqda
- PHP2Shell ekspluatatsiyasi tekshiruvlardan ishlaydigan shellarga o'tmoqda
- Node2Shell: Brotli xatosi Microsoft, Node.js, Python paketlari bo'ylab tuzatishlarni keltirib chiqardi
- Mirai botnet operatorlari PHP2Shell hujumlariga qo'shilmoqda, ASLR chetlab o'tish ekspluatatsiyalari paydo bo'lmoqda
So'nggi yangiliklar
- HHS arizasi iRhythm ma'lumotlar buzilishi sonini 8,2 millionga yetkazdi
- Xitoylik xakerlar past darajali ESXi jurnal xatosini nol-kun sifatida jimgina ishlatishdi
- Ukrain Hive va Nefilim ransomware sherigi AQSh qamoqxonasida 70 oyga hukm qilindi
- Upwind Security 3,8 milliard dollar baholashda 400 million dollar jalb qildi
- Chrome va Firefox yangilanishlari 200 dan ortiq zaiflikni tuzatdi
- TLS xatolari yuzlab million qurilmalarda ishlatiladigan GoAhead veb-serverida topildi
- Xitoy bilan bog'liq xakerlar PHP2Shell orqali firewallarni ildizdan olishmoqda
- EPICS tadqiqot muassasasi nazorat dasturiy ta'minotida uzoq vaqtdan beri yashirin xatolar tuzatildi
Trend
Tailscale «Tailworm» zaifliklarining muvofiqlashtirilmagan oshkor qilinishidan so'ng tezda tuzatishlarni e'lon qildi
Node2Shell: Brotli xatosi Microsoft, Node.js, Python paketlari bo'ylab tuzatishlarni keltirib chiqardi
Xitoy bilan bog'liq xakerlar PHP2Shell orqali firewallarni ildizdan olishmoqda
CISA Node2Shell ekspluatatsiyasidan ogohlantiradi, chunki Honeypotlar hujum urinishlarini qayd etmoqda
iOS, macOS 27.2 286 xatoni tuzatdi; ekspluatatsiya qilingan xato iOS 18 ga qayta portlandi
HPE tarmoq mahsulotlarida o'nlab muhim xatolarni tuzatdi
PHP2Shell ekspluatatsiyasi tekshiruvlardan ishlaydigan shellarga o'tmoqda
Kiberxavfsizlik muammosi yirik Nyu-Meksiko shifoxonasini bemorlarni yo'naltirishga va klinikalarni yopishga majbur qildi
Kundalik axborot byulleteni
So'nggi tahdidlar, tendentsiyalar va texnologiyalar, shuningdek, soha mutaxassislarining chuqur fikrlari haqida xabardor bo'lish uchun SecurityWeek elektron pochta axborotiga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik siyosatimizni o'qing.
Vebinar: Agentik pentest CTEM dasturi uchun
4-noyabr 2026
Pentestlar orasidagi xavfsizlik bo'shliqlarini yoping. Ushbu sessiyaga qo'shiling va agentik pentestni o'rganing hamda CTEM dasturingizda uzluksiz ta'sirni tekshirish uchun amaliy asosga ega bo'ling.
Ro'yxatdan o'ting
Virtual tadbir: CISO Forum 2026 sammiti
10 va 11-noyabr 2026
CISOlar, yuqori darajali kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini birlashtiramiz, korporativ kiberxavfsizlik strategiyasini shakllantiruvchi amaliy tajriba almashish va masalalarni o'rganish uchun.
Ro'yxatdan o'ting
Harakatdagi odamlar
Quantum eMotion Ueyn Tiplni CTO etib tayinladi.
Gay Ellis NCC Group CEO etib tayinlandi.
Noma Security Bobbi Shokerni CFO va Alberto Rodrigesni CCO etib tayinladi.
Ko'proq harakatdagi odamlar
Mutaxassis fikrlari
Hech kim xavfsizlik so'rovnomasiga ishonmaydi. Baribir biz unga tayanamiz.
Deyarli har bir B2B bitimni nazorat qiladigan jarayon — yuboruvchining ishonchsizligi va qabul qiluvchining qabul qilishi bilan o'z-o'zini baholash. Nihoyat kompaniyalar o'rtasida ishonch uchun yaxshiroq asos paydo bo'ldi. (Sravish Sridhar)
Bu yaxshi: NetScaler nol-kunlari bizga yangi normal haqida nima aytadi
Yaqin orada Citrix NetScaler tuzatishlarining yana bir to'plami e'lon qilinishi mumkinligi uchun tuzatish boshqaruv quvurlaringizni tayyor saqlang. (Tod Birdsli)
Zamonaviy kiberhujumlarga qarshi kurashda kontekst qirol
Kontekstual himoya xavfsizlik jamoalariga signallarni bog'lash, keyingi qadamni oldindan bilish va tahdidlar kuchayishidan oldin ularni to'xtatishga yordam beradi. (Etay Maor)
AI dasturiy ta'minot xavfsizligining kaliti tezlik emas, yetuklik
Sizning ishlab chiquvchilaringiz AI qabul qilish shkalasida qayerda joylashganligi siz xavfsizlik xavfini qanday hal qilishingizga haqiqiy ta'sir qiladi. (Matias Madou)
Vulnerabilities
Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
By
Eduard Kovacs
| October 29, 2026 (5:47 AM ET)
*
Cisco on Wednesday released fixes for an exploited vulnerability affecting its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software.
Tracked as CVE-2026-76418 and assigned a CVSS score of 8.6, the bug resides in the Remote Access SSL VPN service. Attackers can exploit it remotely, without authenticating, to force the device to restart unexpectedly and disrupt its availability.
Cisco attributes the issue to logic errors affecting tunnel groups configured with secondary authentication. Exploitation involves a malicious request sent while connecting to the SSL VPN.
“A successful VPN login is not required to reach the affected processing path,” Cisco noted.
For an attack to work, the firewall must be running an unpatched release, have its SSL VPN login service reachable, and use secondary authentication in an affected tunnel group. The company’s cloud-delivered firewall and management offerings, Secure Access, and the Secure Firewall Management Center are not vulnerable.
Cisco’s product security team learned in October that the flaw was being exploited in the wild. No information has been shared about the attacks or the threat actors behind them.
Advertisement. Scroll to continue reading.
The vulnerability came to light during a Cisco TAC support case, and the company credited Eric Fernald with finding it.
No workarounds are available. Depending on the default tunnel group’s settings, customers can reduce their exposure by turning off the tunnel group list or removing secondary authentication. Cisco cautioned that dropping secondary authentication makes remote access VPN less secure, and it recommends upgrading instead.
This is the second ASA and FTD zero-day exploited for DoS attacks in recent months. In August, Cisco released fixes for CVE-2026-20349, an HTTP request processing flaw that also lets unauthenticated attackers remotely trigger a reload through the Remote Access SSL VPN service.
Cisco did not disclose details on those attacks either. It’s unclear whether both flaws were exploited by the same threat actor.
Related: Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Related: Hackers Start Probing Fresh Oracle EBS Vulnerability
Related: China-Linked Hackers Exploit PHP2Shell to Root Firewalls
Written ByEduard Kovacs
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Eduard Kovacs
- CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
- Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
- iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
- Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
- Industrial Vendors Check Products for PHP2Shell Vulnerabilities
- PHP2Shell Exploitation Moves From Probes to Working Shells
- Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
- Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
Latest News
- HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million
- Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
- Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
- Upwind Security Raises$400 Million at$3.8 Billion Valuation
- Chrome and Firefox Updates Patch Over 200 Vulnerabilities
- TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices
- China-Linked Hackers Exploit PHP2Shell to Root Firewalls
- Long-Hidden Flaws Patched in EPICS Research Facility Control Software
Trending
Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
China-Linked Hackers Exploit PHP2Shell to Root Firewalls
CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
HPE Patches Dozens of Critical Flaws in Networking Products
PHP2Shell Exploitation Moves From Probes to Working Shells
Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: Agentic Pentesting for a Stronger CTEM Program
November 4, 2026
Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Quantum eMotion has named Wayne Teeple as CTO.
Guy Ellis has been appointed CEO of NCC Group.
Noma Security has named Bobby Shoker as CFO and Alberto Rodrigues as CCO.
More People On The Move
Expert Insights
*
Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)
This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Context Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)
AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)
