I’M UNDER A CYBER ATTACK

Alert

Alert 2026-129 Active exploitation of DoS vulnerability in Cisco ASA and FTD and new threat actor exploiting critical Cisco SD-WAN vulnerability

Affected product(s):

ProductVulnerabilityAffected versions
Cisco Secure Firewall Adaptive Security Appliance (ASA) SoftwareCVE-2026-76418 (denial of service, CVSS v3.1 8.6)Release branches 9.16 and earlier, 9.18, 9.20, 9.22, 9.23 and 9.24, prior to the first fixed release in each branch
Cisco Secure Firewall Threat Defense (FTD) SoftwareCVE-2026-76418 (denial of service, CVSS v3.1 8.6)Release branches 7.0 and earlier, 7.2, 7.4, 7.6, 7.7, 10.0 and 10.1, prior to the first fixed release in each branch
Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage) and Validator (formerly vBond)CVE-2026-20127 (authentication bypass, CVSS v3.1 10.0)Release branches prior to 20.9, 20.9, 20.11, 20.12, 20.13, 20.14, 20.15, 20.16 and 20.18, prior to the first fixed release in each branch, regardless of configuration

Cisco Cloud-delivered Firewall (CDFW), Cloud-delivered FMC (cdFMC), Secure Access (CSA) and Secure FMC Software are not affected by CVE-2026-76418.

Description

Two Cisco security updates have been published: an advisory about a denial-of-service vulnerability in Cisco Secure Firewall ASA and FTD, whose active exploitation is known to the vendor, and new information about the exploitation of critical Cisco Catalyst SD-WAN vulnerability CVE-2026-20127, previously addressed in Alerts 2026-20 and 2026-50.

Cisco Secure Firewall ASA and FTD (CVE-2026-76418)

The vendor published an advisory on 28/10/2026 about vulnerability CVE-2026-76418 in Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD), which allows a remote unauthenticated attacker to cause an unexpected device restart and, consequently, a denial of service (DoS). It is rated CVSS v3.1 8.6 (High), with a network vector, low attack complexity, no privileges or user interaction required, changed scope and availability-only impact.

The cause is logic errors when secondary authentication is configured in a tunnel group. The flaw is exploited by sending a crafted request when connecting to the remote-access SSL VPN service; a successful VPN login is not required to reach the affected code path.

The vendor indicated that it became aware of active exploitation of this vulnerability in October 2026. It did not report the start date, the responsible actor or any indicators of compromise.

According to the vendor, a device is vulnerable only if it meets all of these conditions: it is running a vulnerable release of ASA or FTD, the remote-access SSL login service is reachable, and secondary authentication is configured in a tunnel group. To verify this:

  • In the running configuration, verify the webvpn keyword with SSL VPN enabled on at least one interface (enable interface_name).
  • If tunnel-group-list enable is configured, review all tunnel groups, including the default DefaultWEBVPNGroup, for secondary-authentication-server-group. The review is not limited to the profiles visible on the login page.
  • If tunnel-group-list enable is not configured, or was removed with no tunnel-group-list enable, still review DefaultWEBVPNGroup: disabling the list does not eliminate the exposure if that group uses secondary authentication.
  • In FTD, review the deployed policy and the resulting configuration in FMC (Devices > VPN > Remote Access) or FDM (Remote Access VPN).

Cisco Catalyst SD-WAN (CVE-2026-20127)

CVE-2026-20127 is an authentication bypass (CVSS v3.1 10.0, Critical) in Cisco Catalyst SD-WAN Controller, Manager and Validator. A remote unauthenticated attacker can, through crafted requests, log in to a Controller as a high-privileged internal user (not root), access NETCONF and manipulate the SD-WAN fabric configuration. It affects deployments regardless of configuration, both On-Prem and in Cisco Hosted SD-WAN Cloud.

Exploitation of this vulnerability was already known: the vendor indicated that it was aware of limited exploitation, the flaw has been listed in the Known Exploited Vulnerabilities (KEV) catalog since 25/02/2026, with a remediation deadline of 27/02/2026, and an emergency directive (ED 26-03) was issued for it.

What is new. On 28/10/2026, the vendor updated its advisory (revision 2.1) solely to add a link to a technical analysis published that same day. Researchers indicate that a second actor, identified as UAT-11473 and described as a highly sophisticated APT group, exploited CVE-2026-20127 on Cisco Catalyst SD-WAN Controller instances to install KeyDrift, custom malware for Cisco SD-WAN controller environments designed to maintain persistent access and automatically exfiltrate key material. They assess with high confidence that UAT-11473’s infrastructure overlaps substantially with Volt Typhoon’s covert access network, “Silent Train”; this is infrastructure overlap, not direct attribution to Volt Typhoon. The observed targets include space and satellite services, defense and aerospace technology, and policy research. The analysis describes historical activity and does not report dates, the number of victims or countries.

KeyDrift operates within SD-WAN control-plane processes and can intercept decrypted control traffic, extract session metadata and key material from the data plane, and store or transmit it encrypted. It consists of:

  • PolyFlame: a memory-resident module deployed through modified runit service paths and injected into legitimate vdaemon processes (a packaged variant named aaamgrd also exists). It functions as a TinyShell-style backdoor (executes /bin/sh -c, reads and writes files, with no interactive shell) and as an intermediate one-to-many C2. It was observed in multiple controller roles and the aaamgrd variant on an affected vBond.
  • LittleFilch (libcommon.so): intercepts SSL_read in vdaemon and extracts the public IP, the peer’s system IP and a 32-byte binary field that researchers assess as data-plane IPsec AES-256 key material distributed via OMP. It encrypts the data with RSA, writes it to /var/tmp/vdaemon.bin and can send it via UDP using the DTLS 1.2 record format. It was observed in an affected vSmart process.

Researchers indicate that the AES-256 keys are an assessment based on the contents of that field, not a confirmed fact. The CVSS, fixed versions and mitigation for CVE-2026-20127 did not change.

KeyDrift indicators of compromise

  • Modified runit services: /etc/sv/sshd/ (the run script remounts /rootfs.rw as executable, launches conf_sshd in the background and then launches the legitimate sshd) and /etc/sv/aaamgr/ (with aaamgrd and a modified launcher that removes the sshd and login PAM configurations from the writable overlay).
  • Files and processes: conf_sshd, rsshd (ptrace injector), libdssl.so (PolyFlame), libcommon.so (LittleFilch) and aaamgrd (static ELF64; the legitimate aaamgr is a Python package and should not be a compiled ELF binary under runit).
  • Work artifacts: /tmp/system-vdaemon (vdaemon PID list), /var/tmp/vdaemon.bin and /var/tmp/vdaemon.conf (the latter is automatically deleted).
  • Timestamp alteration using touch --reference= and chmod --reference=.
  • Network: outbound UDP traffic using the DTLS 1.2 record format (LittleFilch). PolyFlame travels piggyback on SD-WAN control traffic, with no fixed external beacon.
  • The analysis does not publish hashes, IP addresses or domains.
  • Snort coverage: SID 65938 and 65958 for CVE-2026-20127; Snort 2 SIDs 67387 through 67416 and Snort 3 SIDs 7:44 through 7:73 for the KeyDrift artifacts.

Mitigation

Cisco Secure Firewall ASA and FTD (CVE-2026-76418)

The vendor indicated that there are no workarounds. A partial mitigation exists, consisting of disabling secondary authentication in any user-defined tunnel group or in DefaultWEBVPNGroup. These are temporary measures until the update is applied, and the vendor warns that their impact should be assessed before implementation.

If DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel group list in WebVPN mode. Users will no longer be able to select a profile from a list and will need to know the correct profile:

no tunnel-group-list enable

If DefaultWEBVPNGroup uses secondary authentication, remove it. This reduces the security posture of the remote-access VPN:

no secondary-authentication-server-group

Cisco Catalyst SD-WAN (CVE-2026-20127)

There are no workarounds. The temporary mitigation specified by the vendor for On-Prem deployments has not changed:

  • Follow the firewall port guidance and add ACLs, firewall rules or security groups that limit ports 22 and 830 to known controller IP addresses and required hosts.
  • Apply the measures in the Cisco Catalyst SD-WAN hardening guide (linked under Additional Information).
  • In Cisco Hosted SD-WAN Cloud deployments (including Cisco Managed and FedRAMP), those protections are already applied.

To detect unauthorized access, the vendor recommends auditing /var/log/auth.log for Accepted publickey for vmanage-admin from unknown IP addresses and comparing them with the Manager’s System IP (WebUI > Devices > System IP), as well as manually validating all vmanage-type peering events. At any indication, open a case with Cisco TAC and run request admin-tech beforehand. The risk is higher if Controllers are exposed to the Internet.

Regarding KeyDrift, researchers recommend applying patches, following the Cisco hardening guide, monitoring post-compromise activity indicators and, if there are signs of compromise, immediately activating the incident response process and opening a case with Cisco TAC.

Solution

Cisco Secure Firewall ASA and FTD (CVE-2026-76418)

The solution is to update to the first fixed release in the branch in use:

ProductBranchFirst fixed release
ASA9.16 and earlier9.16.4.104
ASA9.189.18.4.96
ASA9.209.20.4.50
ASA9.229.22.3.200
ASA9.239.23.1.48
ASA9.249.24.1.27 and 9.24.10.1
FTD7.0 and earlier7.0.11
FTD7.27.2.13
FTD7.47.4.9
FTD7.67.6.7
FTD7.77.7.14
FTD10.010.0.3
FTD10.110.1.1

The advisory lists both fixed releases under the 9.24 branch without specifying which subbranch each corresponds to. ASA branches 9.17, 9.19 and 9.21 and FTD branches 7.1, 7.3 and 7.5 do not appear in the advisory’s table, and it does not indicate what to do with them; the advisory’s CSAF file does include ASA 9.19 and FTD 7.3 as affected. For these branches, consult the Cisco Software Checker or Cisco.

Cisco Catalyst SD-WAN (CVE-2026-20127)

The solution is to update to the first fixed release in the branch in use. Branches marked with (1) have reached the end of software maintenance, and the vendor recommends moving to a supported release:

Catalyst SD-WAN branchFirst fixed release
Prior to 20.9 (1)Migrate to a fixed release
20.920.9.8.2
20.11 (1)20.12.6.1
20.1220.12.5.3 or 20.12.6.1
20.13 (1)20.15.4.2
20.14 (1)20.15.4.2
20.1520.15.4.2
20.16 (1)20.18.2.1
20.1820.18.2.1

Additional Information: