Technology · Cybersecurity
Cisco confirmed on Wednesday that attackers are already exploiting a firewall VPN flaw that can crash ASA and FTD devices without any login — while its own Talos researchers tied a second, maximum-severity SD-WAN flaw to key-stealing malware and a covert network used by China’s Volt Typhoon.
SAN JOSE, Calif. — Cisco handed network administrators two emergencies on Wednesday. The company released fixes for a firewall vulnerability it says attackers are already exploiting in the wild — and, in a separate disclosure, its Talos threat-intelligence unit tied a second, far more serious flaw in Cisco’s SD-WAN controllers to a key-stealing malware framework and to infrastructure overlapping the covert access network used by Volt Typhoon, the Chinese state-sponsored group accused of burrowing into American critical infrastructure.
The firewall flaw, tracked as CVE-2026-76418 and rated 8.6 out of 10 in severity, sits in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Cisco said its Product Security Incident Response Team (PSIRT) became aware of active exploitation in October 2026. The bug stems from logic errors that surface when secondary authentication is configured on a tunnel group: an unauthenticated remote attacker can send a crafted request while connecting to the SSL VPN and force the device to reload unexpectedly, producing a denial-of-service condition that drops the firewall and the sessions behind it. A successful VPN login is not required to reach the vulnerable code path — the flaw can be triggered by someone who never authenticates.
SecurityWeek noted that this is the second actively exploited Cisco firewall VPN zero-day since August. But the two disclosures are different kinds of emergency. The firewall flaw is a smash: loud, immediate, fixable with an upgrade. The SD-WAN flaw is a burglary: quiet, patient, aimed at the keys that protect network traffic, and connected — on Talos’s own assessment — to one of the most closely watched Chinese intrusion campaigns in the world. What links them is the class of device involved: not a laptop or a phone, but the machinery that guards and manages the network itself.
The firewall flaw, in detail
The vulnerability was discovered by Eric Fernald while resolving a Cisco Technical Assistance Center support case — it surfaced in the field, in real customer work, rather than in a laboratory audit. The exposure conditions are specific. A device is affected only when the SSL VPN service is enabled and reachable — the webvpn configuration on at least one interface — and secondary authentication is configured on a tunnel group. Administrators must check the default tunnel group, DefaultWEBVPNGroup; and if the tunnel-group list is enabled, every tunnel group counts, including groups not shown on the login page. Turning the list off does not end the exposure if the default group still uses secondary authentication.
There are no workarounds. Short of patching, Cisco lists mitigations only: disable secondary authentication on the default tunnel group, or turn off the tunnel-group list where the default group does not use it. The company is candid about the cost — removing secondary authentication makes VPN login less secure — and recommends upgrading instead of weakening authentication to dodge a crash bug. Not every customer needs to act: Cisco’s cloud-delivered firewall, Secure Access and Secure Firewall Management Center are not affected.
What Cisco has not provided is any account of the exploitation itself: no information about who is exploiting the flaw, who has been targeted, or what indicators of compromise defenders should hunt for. That silence, addressed again below, shapes what administrators can actually do — patch on trust, with no telemetry to check against.
First fixed releases: patch to these versions
Cisco Secure Firewall ASA software — first fixed releases:
- 9.16 and earlier — fixed in 9.16.4.104
- 9.18 — fixed in 9.18.4.96
- 9.20 — fixed in 9.20.4.50
- 9.22 — fixed in 9.22.3.200
- 9.23 — fixed in 9.23.1.48
- 9.24 — fixed in 9.24.1.27 and 9.24.10.1
Cisco Secure Firewall Threat Defense (FTD) software — first fixed releases:
- 7.0 and earlier — fixed in 7.0.11
- 7.2 — fixed in 7.2.13
- 7.4 — fixed in 7.4.9
- 7.6 — fixed in 7.6.7
- 7.7 — fixed in 7.7.14
- 10.0 — fixed in 10.0.3
- 10.1 — fixed in 10.1.1
A maximum-severity SD-WAN flaw, and malware built to steal the keys
The same Wednesday, Cisco Talos reported that a threat actor it tracks as UAT-11473 exploited CVE-2026-20127, a flaw with the maximum possible severity score of 10.0 in Cisco Catalyst SD-WAN controller components. The flaw was disclosed on February 25, 2026, and it is remotely exploitable without any credentials: it bypasses peering authentication, hands the attacker administrative rights, and can be used to alter the configuration of the SD-WAN network itself. An SD-WAN controller is, by design, the brain of the network it manages — the component that tells branch offices, data centers and cloud workloads how to reach one another. Administrative control of it is not a foothold in the network. In a meaningful sense, it is the network.
Talos describes UAT-11473 as a highly sophisticated advanced persistent threat actor targeting space and satellite services, defense and aerospace technology, and policy research. Talos calls the activity historical and does not say when it occurred — leaving open whether the intrusions are recent, years old, or both. What the actor did with its access, however, Talos describes in detail: it planted a custom malware framework, named KeyDrift, built to persist inside the SD-WAN control plane and automatically siphon off keying material.
KeyDrift: PolyFlame and LittleFilch
KeyDrift is injected into legitimate control-plane processes, operating inside the trusted machinery of the controller rather than alongside it. From that position it can reach control traffic after decryption — the point where the network’s most sensitive material is briefly in the clear. The framework is designed, Talos says, for long-term persistent access and to automatically exfiltrate keying material, the cryptographic keys that authenticate and protect the network’s own communications.
Its main module, PolyFlame, works as a backdoor and can relay commands to other hosts as an intermediate command-and-control node, turning one compromised controller into a stepping stone against others. A second module, LittleFilch, is the collection specialist: it gathers keying material Talos believes includes the keys protecting data-plane traffic — the actual user data flowing across the SD-WAN. An intruder holding those keys does not merely watch the management channel. It holds the means to compromise the traffic the network exists to carry.
Silent Train: the covert network behind the campaigns
Talos assessed with high confidence that UAT-11473’s infrastructure “overlaps considerably” with the covert access network that Lumen’s Black Lotus Labs calls Silent Train and attributes to Volt Typhoon. Precision matters here, because Wednesday’s two reports do not say the same thing. Talos does not say UAT-11473 and Volt Typhoon are the same group; it says their infrastructure overlaps. Lumen’s report does not mention KeyDrift or UAT-11473 at all. Read together, they are two lenses on one piece of terrain: a Cisco actor whose tooling points toward a network a second research team has spent years mapping to a Chinese state-sponsored group.
Black Lotus Labs says it has monitored Silent Train since late 2023. The network routes traffic through chains of compromised small-office and home-office routers, Internet of Things devices and enterprise systems — relays that are frequently replaced and disposable by design. Its operators deploy only the tooling each session needs, and clean up after themselves when it ends. The discipline leaves defenders little stable infrastructure to block and little residue to reconstruct — but Lumen’s long watch produced hundreds of victim notifications, and helped uncover a series of zero-day campaigns that might otherwise have stayed buried.
According to Lumen, at least four confirmed zero-day campaigns ran through Silent Train, with a fifth assessed as likely:
- Versa Director — CVE-2024-39717, disclosed August 2024.
- N-able N-central — CVE-2025-8875 and CVE-2025-8876, exploited in 2025.
- Cisco Catalyst SD-WAN — CVE-2026-20127, disclosed February 25, 2026.
- Arista VeloCloud Orchestrator — CVE-2026-16812, rated CVSS 10.0, disclosed July 27, 2026.
- Quest KACE — a likely fifth zero-day campaign, not confirmed.
Every confirmed campaign on that list targeted a management or control-plane platform — not an endpoint, not a user application, but the systems that administer other systems. Lumen says Volt Typhoon was exploiting the Cisco SD-WAN flaw by late 2025 and kept exploiting it long after Cisco’s February disclosure, a reminder that publication of a patch and remediation of a fleet are very different events. The victim set Lumen describes spans telecoms firms, government entities, defense contractors, satellite and mission-critical communications providers, managed service providers, universities with military ties, and critical infrastructure operators. Within the United States, Hawaii, California and Texas were targeted the most.
Why this matters
Control planes are the prize
The four confirmed Silent Train campaigns share a target logic that should reorganize how defenders think about exposure. Whoever owns the controller owns every network it manages: its configurations, its credentials, its topology, and its ability to redirect or observe traffic at scale. One flaw in a management platform can be worth more than a thousand in the devices it manages, because the platform is where trust is concentrated. That is why Versa Director, N-central, Catalyst SD-WAN and VeloCloud Orchestrator — four vendors, four products — appear on the same list. The attackers are not shopping for brands. They are shopping for altitude.
Key theft outlives patching
KeyDrift’s purpose creates a second, quieter problem. Patching CVE-2026-20127 closes the door the intruders used; it does nothing about keys they may already have carried out. Stolen keying material can compromise traffic even after the hole is closed, so SD-WAN victims face a re-keying problem, not just an upgrade: rotate the material, re-establish trust across the fabric, and treat anything the old keys protected as exposed until proven otherwise. An implant built to harvest keys automatically, over long dwell times, turns a disclosure into the start of an investigation rather than the end of one.
Pre-positioning, espionage — or both
Volt Typhoon has been active since at least mid-2021 and was publicly identified by Microsoft in May 2023, over intrusions into critical infrastructure in Guam and across the continental United States. The standing question about the group is not whether it is inside American networks, but why. Lumen’s read of the Silent Train victimology points to pre-positioning: footholds held for a geopolitical crisis, particularly one involving the Indo-Pacific and Taiwan. Yet researcher Mike Horka told journalist Kim Zetter the hackers also exfiltrated documents on military operations and network structures — classic espionage, alongside the pre-positioning. A January 2026 analysis for the International Institute for Strategic Studies by John Bruce argued that most targeted networks offered little conventional intelligence value, and that collecting network diagrams and operating manuals points to preparation for possible disruption. That remains an assessment, not proof of an ordered attack — but Wednesday’s target list, heavy with satellite, defense and communications providers, does nothing to weaken it. The pattern sits inside a wider Washington–Beijing technology confrontation that now runs from network equipment to genomics, where the United States this week banned imports from BGI Genomics and MGI Tech over forced-labor concerns.
A crash-only flaw still matters
It is tempting to file CVE-2026-76418 as the lesser story: a denial-of-service bug, no code execution, no data theft. That undersells what a reload-on-demand flaw does at the perimeter. A VPN gateway is the front door for a remote workforce and, often, for incident responders. An attacker who can force that door to slam shut, repeatedly and without credentials, can blind remote access during an incident, exhaust operations teams with manufactured outages, and raise noise behind which other activity hides. The context is a drumbeat: the second actively exploited Cisco firewall VPN zero-day since August, in the same week that a cyberattack took the Federal Election Commission’s filing system offline for 41 hours. Edge devices remain the soft underbelly of enterprise networks — always on, always reachable, too often patched last.
Disclosure gaps leave defenders with one signal
Finally, there is what Cisco did not say. For the firewall exploitation: no threat actor, no victim description, no indicators of compromise. Defenders cannot hunt for what has not been described; their only real signal is the patch itself, applied on the vendor’s say-so. That is becoming the pattern rather than the exception — at a moment when, as Signal Post News has reported, AI-assisted vulnerability discovery is doubling the flow of flaws faster than disclosure practice is adapting. The asymmetry is stark: the attackers know exactly what they did, the vendor knows some of it, and the organizations running the devices know only that they should upgrade quickly and hope the upgrade is the whole remedy. For SD-WAN customers who may have hosted KeyDrift, it is not.
What administrators should do now
- Patch the perimeter first. Upgrade internet-facing ASA and FTD VPN head-ends to the first fixed releases listed above before touching anything else; CVE-2026-76418 is being exploited now.
- Audit SD-WAN controllers. Confirm the CVE-2026-20127 fix is applied, and hunt for unexpected configuration changes, unfamiliar administrative accounts and unauthorized peers.
- Treat odd reloads as evidence. Unexpected firewall reloads and crash files on VPN gateways are a signal worth investigating, not noise to clear and forget.
- Re-key if compromise is suspected. If an SD-WAN compromise is possible, rotate and re-issue keying material; stolen keys outlive the patch.
- Inventory every exposed management plane. List every internet-reachable edge and orchestration system — Versa, N-able, VeloCloud and Quest KACE included — and restrict administrative access to them.
- Do not lean on the mitigation. Removing secondary authentication weakens VPN login; treat it only as a temporary, explicitly risk-accepted bridge to the upgrade.
What happens next
Three things are worth watching. The first is the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog: as of reporting on the firewall flaw on October 29, CISA had not yet added either flaw to it, and a listing would convert Cisco’s recommendation into a federal deadline. The second is whether Cisco or Talos publish indicators of compromise — the detail that would let thousands of organizations check their own networks rather than simply upgrade and wonder. The third is whether more Silent Train campaigns surface. Four confirmed management-platform zero-day campaigns have now run through one covert network since 2024, plus a likely fifth; a network built to leave nothing behind is unlikely to have left its full history in plain sight. That is analysis, not a claim of a specific undisclosed campaign — but the burden of proof has shifted. The question is no longer whether sophisticated actors are hunting control planes. It is which ones have already been found.
Sources
- Cisco Security Advisory, October 28, 2026 — Cisco Secure Firewall ASA and FTD Software Remote Access SSL VPN tunnel denial-of-service vulnerability (CVE-2026-76418): the official vendor advisory, including the exploitation notice from Cisco PSIRT, the secondary-authentication exposure conditions, the absence of workarounds, the mitigations, and the first fixed ASA and FTD releases.
- SecurityWeek, October 2026 — “Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August”: the framing of CVE-2026-76418 as the second exploited Cisco firewall VPN zero-day since August, the Eric Fernald TAC discovery credit, and Cisco’s caution that removing secondary authentication weakens VPN security.
- SecurityWeek, October 2026 — “Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network”: the Talos UAT-11473 and KeyDrift reporting and the Lumen Black Lotus Labs Silent Train research, including the four confirmed zero-day campaigns and the victim sectors.
- BleepingComputer, October 2026 — “New Cisco firewall zero-day exploited to crash SSL VPN devices”: corroborating coverage of the CVE-2026-76418 exploitation, Cisco’s October PSIRT awareness, the absence of published indicators of compromise, and the DefaultWEBVPNGroup mitigation.
- The Hacker News, October 29, 2026 — “Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls”: the fixed-release table for ASA and FTD, the tunnel-group-list exposure checks, and Talos’s description of KeyDrift, PolyFlame and LittleFilch.