{"id":12288,"date":"2026-10-28T19:12:31","date_gmt":"2026-10-29T01:12:31","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\/"},"modified":"2026-10-28T19:13:41","modified_gmt":"2026-10-29T01:13:41","slug":"alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\/","title":{"rendered":"Alert 2026-129 Active exploitation of DoS vulnerability in Cisco ASA and FTD and new threat actor exploiting critical Cisco SD-WAN vulnerability"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Affected product(s):<\/h2>\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Product<\/strong><\/td><td><strong>Vulnerability<\/strong><\/td><td><strong>Affected versions<\/strong><\/td><\/tr><tr><td><strong>Cisco Secure Firewall Adaptive Security Appliance (ASA) Software<\/strong><\/td><td>CVE-2026-76418 (denial of service, CVSS v3.1 8.6)<\/td><td>Release branches 9.16 and earlier, 9.18, 9.20, 9.22, 9.23 and 9.24, prior to the first fixed release in each branch<\/td><\/tr><tr><td><strong>Cisco Secure Firewall Threat Defense (FTD) Software<\/strong><\/td><td>CVE-2026-76418 (denial of service, CVSS v3.1 8.6)<\/td><td>Release branches 7.0 and earlier, 7.2, 7.4, 7.6, 7.7, 10.0 and 10.1, prior to the first fixed release in each branch<\/td><\/tr><tr><td><strong>Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage) and Validator (formerly vBond)<\/strong><\/td><td>CVE-2026-20127 (authentication bypass, CVSS v3.1 10.0)<\/td><td>Release branches prior to 20.9, 20.9, 20.11, 20.12, 20.13, 20.14, 20.15, 20.16 and 20.18, prior to the first fixed release in each branch, regardless of configuration<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<p class=\"wp-block-paragraph\">Cisco Cloud-delivered Firewall (CDFW), Cloud-delivered FMC (cdFMC), Secure Access (CSA) and Secure FMC Software are not affected by CVE-2026-76418.<\/p>\n\n<h2 class=\"wp-block-heading\">Description<\/h2>\n\n<p class=\"wp-block-paragraph\">Two Cisco security updates have been published: an advisory about a denial-of-service vulnerability in Cisco Secure Firewall ASA and FTD, whose active exploitation is known to the vendor, and new information about the exploitation of critical Cisco Catalyst SD-WAN vulnerability CVE-2026-20127, previously addressed in Alerts <a href=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-20-critical-vulnerability-in-cisco-sd-wan\/\">2026-20<\/a> and <a href=\"https:\/\/beaconlab.us\/publicacion\/alerta-2026-50-zero-day-en-cisco-catalyst-sd-wan-permite-control-total-del-fabric-via-auth-bypass\/\">2026-50<\/a>.<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>Cisco Secure Firewall ASA and FTD (CVE-2026-76418)<\/strong><\/p>\n\n<p class=\"wp-block-paragraph\">The vendor published an advisory on 28\/10\/2026 about vulnerability CVE-2026-76418 in Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD), which allows a remote unauthenticated attacker to cause an unexpected device restart and, consequently, a denial of service (DoS). It is rated CVSS v3.1 8.6 (High), with a network vector, low attack complexity, no privileges or user interaction required, changed scope and availability-only impact.<\/p>\n\n<p class=\"wp-block-paragraph\">The cause is logic errors when secondary authentication is configured in a tunnel group. The flaw is exploited by sending a crafted request when connecting to the remote-access SSL VPN service; a successful VPN login is not required to reach the affected code path.<\/p>\n\n<p class=\"wp-block-paragraph\">The vendor indicated that it became aware of active exploitation of this vulnerability in October 2026. It did not report the start date, the responsible actor or any indicators of compromise.<\/p>\n\n<p class=\"wp-block-paragraph\">According to the vendor, a device is vulnerable only if it meets all of these conditions: it is running a vulnerable release of ASA or FTD, the remote-access SSL login service is reachable, and secondary authentication is configured in a tunnel group. To verify this:<\/p>\n\n<ul class=\"wp-block-list\">\n<li>In the running configuration, verify the <code>webvpn<\/code> keyword with SSL VPN enabled on at least one interface (<code>enable interface_name<\/code>).<\/li>\n\n\n\n<li>If <code>tunnel-group-list enable<\/code> is configured, review all tunnel groups, including the default <code>DefaultWEBVPNGroup<\/code>, for <code>secondary-authentication-server-group<\/code>. The review is not limited to the profiles visible on the login page.<\/li>\n\n\n\n<li>If <code>tunnel-group-list enable<\/code> is not configured, or was removed with <code>no tunnel-group-list enable<\/code>, still review <code>DefaultWEBVPNGroup<\/code>: disabling the list does not eliminate the exposure if that group uses secondary authentication.<\/li>\n\n\n\n<li>In FTD, review the deployed policy and the resulting configuration in FMC (Devices &gt; VPN &gt; Remote Access) or FDM (Remote Access VPN).<\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\"><strong>Cisco Catalyst SD-WAN (CVE-2026-20127)<\/strong><\/p>\n\n<p class=\"wp-block-paragraph\">CVE-2026-20127 is an authentication bypass (CVSS v3.1 10.0, Critical) in Cisco Catalyst SD-WAN Controller, Manager and Validator. A remote unauthenticated attacker can, through crafted requests, log in to a Controller as a high-privileged internal user (not root), access NETCONF and manipulate the SD-WAN fabric configuration. It affects deployments regardless of configuration, both On-Prem and in Cisco Hosted SD-WAN Cloud.<\/p>\n\n<p class=\"wp-block-paragraph\">Exploitation of this vulnerability was already known: the vendor indicated that it was aware of limited exploitation, the flaw has been listed in the Known Exploited Vulnerabilities (KEV) catalog since 25\/02\/2026, with a remediation deadline of 27\/02\/2026, and an emergency directive (ED 26-03) was issued for it.<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>What is new.<\/strong> On 28\/10\/2026, the vendor updated its advisory (revision 2.1) solely to add a link to a technical analysis published that same day. Researchers indicate that a second actor, identified as UAT-11473 and described as a highly sophisticated APT group, exploited CVE-2026-20127 on Cisco Catalyst SD-WAN Controller instances to install KeyDrift, custom malware for Cisco SD-WAN controller environments designed to maintain persistent access and automatically exfiltrate key material. They assess with high confidence that UAT-11473&#8217;s infrastructure overlaps substantially with Volt Typhoon&#8217;s covert access network, \u201cSilent Train\u201d; this is infrastructure overlap, not direct attribution to Volt Typhoon. The observed targets include space and satellite services, defense and aerospace technology, and policy research. The analysis describes historical activity and does not report dates, the number of victims or countries.<\/p>\n\n<p class=\"wp-block-paragraph\">KeyDrift operates within SD-WAN control-plane processes and can intercept decrypted control traffic, extract session metadata and key material from the data plane, and store or transmit it encrypted. It consists of:<\/p>\n\n<ul class=\"wp-block-list\">\n<li>PolyFlame: a memory-resident module deployed through modified runit service paths and injected into legitimate <code>vdaemon<\/code> processes (a packaged variant named <code>aaamgrd<\/code> also exists). It functions as a TinyShell-style backdoor (executes <code>\/bin\/sh -c<\/code>, reads and writes files, with no interactive shell) and as an intermediate one-to-many C2. It was observed in multiple controller roles and the <code>aaamgrd<\/code> variant on an affected vBond.<\/li>\n\n\n\n<li>LittleFilch (<code>libcommon.so<\/code>): intercepts <code>SSL_read<\/code> in <code>vdaemon<\/code> and extracts the public IP, the peer&#8217;s system IP and a 32-byte binary field that researchers assess as data-plane IPsec AES-256 key material distributed via OMP. It encrypts the data with RSA, writes it to <code>\/var\/tmp\/vdaemon.bin<\/code> and can send it via UDP using the DTLS 1.2 record format. It was observed in an affected vSmart process.<\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\">Researchers indicate that the AES-256 keys are an assessment based on the contents of that field, not a confirmed fact. The CVSS, fixed versions and mitigation for CVE-2026-20127 did not change.<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>KeyDrift indicators of compromise<\/strong><\/p>\n\n<ul class=\"wp-block-list\">\n<li>Modified runit services: <code>\/etc\/sv\/sshd\/<\/code> (the <code>run<\/code> script remounts <code>\/rootfs.rw<\/code> as executable, launches <code>conf_sshd<\/code> in the background and then launches the legitimate sshd) and <code>\/etc\/sv\/aaamgr\/<\/code> (with <code>aaamgrd<\/code> and a modified launcher that removes the sshd and login PAM configurations from the writable overlay).<\/li>\n\n\n\n<li>Files and processes: <code>conf_sshd<\/code>, <code>rsshd<\/code> (ptrace injector), <code>libdssl.so<\/code> (PolyFlame), <code>libcommon.so<\/code> (LittleFilch) and <code>aaamgrd<\/code> (static ELF64; the legitimate aaamgr is a Python package and should not be a compiled ELF binary under runit).<\/li>\n\n\n\n<li>Work artifacts: <code>\/tmp\/system-vdaemon<\/code> (vdaemon PID list), <code>\/var\/tmp\/vdaemon.bin<\/code> and <code>\/var\/tmp\/vdaemon.conf<\/code> (the latter is automatically deleted).<\/li>\n\n\n\n<li>Timestamp alteration using <code>touch --reference=<\/code> and <code>chmod --reference=<\/code>.<\/li>\n\n\n\n<li>Network: outbound UDP traffic using the DTLS 1.2 record format (LittleFilch). PolyFlame travels piggyback on SD-WAN control traffic, with no fixed external beacon.<\/li>\n\n\n\n<li>The analysis does not publish hashes, IP addresses or domains.<\/li>\n\n\n\n<li>Snort coverage: SID 65938 and 65958 for CVE-2026-20127; Snort 2 SIDs 67387 through 67416 and Snort 3 SIDs 7:44 through 7:73 for the KeyDrift artifacts.<\/li>\n<\/ul>\n\n<h2 class=\"wp-block-heading\">Mitigation<\/h2>\n\n<p class=\"wp-block-paragraph\"><strong>Cisco Secure Firewall ASA and FTD (CVE-2026-76418)<\/strong><\/p>\n\n<p class=\"wp-block-paragraph\">The vendor indicated that there are no workarounds. A partial mitigation exists, consisting of disabling secondary authentication in any user-defined tunnel group or in <code>DefaultWEBVPNGroup<\/code>. These are temporary measures until the update is applied, and the vendor warns that their impact should be assessed before implementation.<\/p>\n\n<p class=\"wp-block-paragraph\">If <code>DefaultWEBVPNGroup<\/code> does not use secondary authentication, disable the tunnel group list in WebVPN mode. Users will no longer be able to select a profile from a list and will need to know the correct profile:<\/p>\n\n<pre class=\"wp-block-code\"><code>no tunnel-group-list enable<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">If <code>DefaultWEBVPNGroup<\/code> uses secondary authentication, remove it. This reduces the security posture of the remote-access VPN:<\/p>\n\n<pre class=\"wp-block-code\"><code>no secondary-authentication-server-group<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\"><strong>Cisco Catalyst SD-WAN (CVE-2026-20127)<\/strong><\/p>\n\n<p class=\"wp-block-paragraph\">There are no workarounds. The temporary mitigation specified by the vendor for On-Prem deployments has not changed:<\/p>\n\n<ul class=\"wp-block-list\">\n<li>Follow the firewall port guidance and add ACLs, firewall rules or security groups that limit ports 22 and 830 to known controller IP addresses and required hosts.<\/li>\n\n\n\n<li>Apply the measures in the Cisco Catalyst SD-WAN hardening guide (linked under Additional Information).<\/li>\n\n\n\n<li>In Cisco Hosted SD-WAN Cloud deployments (including Cisco Managed and FedRAMP), those protections are already applied.<\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\">To detect unauthorized access, the vendor recommends auditing <code>\/var\/log\/auth.log<\/code> for <code>Accepted publickey for vmanage-admin<\/code> from unknown IP addresses and comparing them with the Manager&#8217;s System IP (WebUI &gt; Devices &gt; System IP), as well as manually validating all vmanage-type peering events. At any indication, open a case with Cisco TAC and run <code>request admin-tech<\/code> beforehand. The risk is higher if Controllers are exposed to the Internet.<\/p>\n\n<p class=\"wp-block-paragraph\">Regarding KeyDrift, researchers recommend applying patches, following the Cisco hardening guide, monitoring post-compromise activity indicators and, if there are signs of compromise, immediately activating the incident response process and opening a case with Cisco TAC.<\/p>\n\n<h2 class=\"wp-block-heading\">Solution<\/h2>\n\n<p class=\"wp-block-paragraph\"><strong>Cisco Secure Firewall ASA and FTD (CVE-2026-76418)<\/strong><\/p>\n\n<p class=\"wp-block-paragraph\">The solution is to update to the first fixed release in the branch in use:<\/p>\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Product<\/strong><\/td><td><strong>Branch<\/strong><\/td><td><strong>First fixed release<\/strong><\/td><\/tr><tr><td><strong>ASA<\/strong><\/td><td>9.16 and earlier<\/td><td>9.16.4.104<\/td><\/tr><tr><td><strong>ASA<\/strong><\/td><td>9.18<\/td><td>9.18.4.96<\/td><\/tr><tr><td><strong>ASA<\/strong><\/td><td>9.20<\/td><td>9.20.4.50<\/td><\/tr><tr><td><strong>ASA<\/strong><\/td><td>9.22<\/td><td>9.22.3.200<\/td><\/tr><tr><td><strong>ASA<\/strong><\/td><td>9.23<\/td><td>9.23.1.48<\/td><\/tr><tr><td><strong>ASA<\/strong><\/td><td>9.24<\/td><td>9.24.1.27 and 9.24.10.1<\/td><\/tr><tr><td><strong>FTD<\/strong><\/td><td>7.0 and earlier<\/td><td>7.0.11<\/td><\/tr><tr><td><strong>FTD<\/strong><\/td><td>7.2<\/td><td>7.2.13<\/td><\/tr><tr><td><strong>FTD<\/strong><\/td><td>7.4<\/td><td>7.4.9<\/td><\/tr><tr><td><strong>FTD<\/strong><\/td><td>7.6<\/td><td>7.6.7<\/td><\/tr><tr><td><strong>FTD<\/strong><\/td><td>7.7<\/td><td>7.7.14<\/td><\/tr><tr><td><strong>FTD<\/strong><\/td><td>10.0<\/td><td>10.0.3<\/td><\/tr><tr><td><strong>FTD<\/strong><\/td><td>10.1<\/td><td>10.1.1<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<p class=\"wp-block-paragraph\">The advisory lists both fixed releases under the 9.24 branch without specifying which subbranch each corresponds to. ASA branches 9.17, 9.19 and 9.21 and FTD branches 7.1, 7.3 and 7.5 do not appear in the advisory&#8217;s table, and it does not indicate what to do with them; the advisory&#8217;s CSAF file does include ASA 9.19 and FTD 7.3 as affected. For these branches, consult the Cisco Software Checker or Cisco.<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>Cisco Catalyst SD-WAN (CVE-2026-20127)<\/strong><\/p>\n\n<p class=\"wp-block-paragraph\">The solution is to update to the first fixed release in the branch in use. Branches marked with (1) have reached the end of software maintenance, and the vendor recommends moving to a supported release:<\/p>\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Catalyst SD-WAN branch<\/strong><\/td><td><strong>First fixed release<\/strong><\/td><\/tr><tr><td><strong>Prior to 20.9 (1)<\/strong><\/td><td>Migrate to a fixed release<\/td><\/tr><tr><td><strong>20.9<\/strong><\/td><td>20.9.8.2<\/td><\/tr><tr><td><strong>20.11 (1)<\/strong><\/td><td>20.12.6.1<\/td><\/tr><tr><td><strong>20.12<\/strong><\/td><td>20.12.5.3 or 20.12.6.1<\/td><\/tr><tr><td><strong>20.13 (1)<\/strong><\/td><td>20.15.4.2<\/td><\/tr><tr><td><strong>20.14 (1)<\/strong><\/td><td>20.15.4.2<\/td><\/tr><tr><td><strong>20.15<\/strong><\/td><td>20.15.4.2<\/td><\/tr><tr><td><strong>20.16 (1)<\/strong><\/td><td>20.18.2.1<\/td><\/tr><tr><td><strong>20.18<\/strong><\/td><td>20.18.2.1<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<h2 class=\"wp-block-heading\">Additional Information:<\/h2>\n\n<ul class=\"wp-block-list\">\n<li>Cisco \u2014 ASA and FTD security advisory (CVE-2026-76418):<br \/><a href=\"https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-asaftd-tunnel-dos-s6mgkb75\" target=\"_blank\" rel=\"noopener\">https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-asaftd-tunnel-dos-s6mgkb75<\/a><\/li>\n\n\n\n<li>Cisco \u2014 ASA and FTD advisory in CSAF format:<br \/><a href=\"https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-asaftd-tunnel-dos-s6mgkb75\/csaf\/cisco-sa-asaftd-tunnel-dos-s6mgkb75.json\" target=\"_blank\" rel=\"noopener\">https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-asaftd-tunnel-dos-s6mgkb75\/csaf\/cisco-sa-asaftd-tunnel-dos-s6mgkb75.json<\/a><\/li>\n\n\n\n<li>Cisco \u2014 Software Checker to determine whether a release is affected:<br \/><a href=\"https:\/\/sec.cloudapps.cisco.com\/security\/center\/softwarechecker.x\" target=\"_blank\" rel=\"noopener\">https:\/\/sec.cloudapps.cisco.com\/security\/center\/softwarechecker.x<\/a><\/li>\n\n\n\n<li>Cisco \u2014 Catalyst SD-WAN security advisory (CVE-2026-20127, revision 2.1):<br \/><a href=\"https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-sdwan-rpa-EHchtZk\" target=\"_blank\" rel=\"noopener\">https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-sdwan-rpa-EHchtZk<\/a><\/li>\n\n\n\n<li>Cisco \u2014 Catalyst SD-WAN advisory in CSAF format:<br \/><a href=\"https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-sdwan-rpa-EHchtZk\/csaf\/cisco-sa-sdwan-rpa-EHchtZk.json\" target=\"_blank\" rel=\"noopener\">https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-sdwan-rpa-EHchtZk\/csaf\/cisco-sa-sdwan-rpa-EHchtZk.json<\/a><\/li>\n\n\n\n<li>Cisco \u2014 Cisco Catalyst SD-WAN hardening guide:<br \/><a href=\"https:\/\/sec.cloudapps.cisco.com\/security\/center\/resources\/Cisco-Catalyst-SD-WAN-HardeningGuide\" target=\"_blank\" rel=\"noopener\">https:\/\/sec.cloudapps.cisco.com\/security\/center\/resources\/Cisco-Catalyst-SD-WAN-HardeningGuide<\/a><\/li>\n\n\n\n<li>Cisco Talos \u2014 analysis of UAT-11473 and KeyDrift (28\/10\/2026):<br \/><a href=\"https:\/\/blog.talosintelligence.com\/uat-11473-keydrift\/\" target=\"_blank\" rel=\"noopener\">https:\/\/blog.talosintelligence.com\/uat-11473-keydrift\/<\/a><\/li>\n\n\n\n<li>Cisco Talos \u2014 analysis of UAT-8616 in Cisco SD-WAN:<br \/><a href=\"https:\/\/blog.talosintelligence.com\/uat-8616-sd-wan\/\" target=\"_blank\" rel=\"noopener\">https:\/\/blog.talosintelligence.com\/uat-8616-sd-wan\/<\/a><\/li>\n\n\n\n<li>CISA \u2014 Known Exploited Vulnerabilities (KEV) catalog:<br \/><a href=\"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog\" target=\"_blank\" rel=\"noopener\">https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog<\/a><\/li>\n\n\n\n<li>CISA \u2014 ED 26-03 emergency directive on Cisco SD-WAN systems:<br \/><a href=\"https:\/\/www.cisa.gov\/news-events\/directives\/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems\" target=\"_blank\" rel=\"noopener\">https:\/\/www.cisa.gov\/news-events\/directives\/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems<\/a><\/li>\n\n\n\n<li>CISA \u2014 supplemental hunting and hardening guidance for ED 26-03:<br \/><a href=\"https:\/\/www.cisa.gov\/news-events\/directives\/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems\" target=\"_blank\" rel=\"noopener\">https:\/\/www.cisa.gov\/news-events\/directives\/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems<\/a><\/li>\n\n\n\n<li>Lumen Black Lotus Labs \u2014 Silent Train, Volt Typhoon&#8217;s operational framework:<br \/><a href=\"https:\/\/www.lumen.com\/blog\/en-us\/silent-train-volt-typhoon-operational-framework\" target=\"_blank\" rel=\"noopener\">https:\/\/www.lumen.com\/blog\/en-us\/silent-train-volt-typhoon-operational-framework<\/a><\/li>\n\n\n\n<li>Beacon Lab \u2014 Alert 2026-20, critical vulnerability in Cisco SD-WAN:<br \/><a href=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-20-critical-vulnerability-in-cisco-sd-wan\/\" target=\"_blank\" rel=\"noopener\">https:\/\/beaconlab.us\/publicacion\/alerta-2026-20-vulnerabilidad-critica-en-cisco-sd-wan\/<\/a><\/li>\n\n\n\n<li>Beacon Lab \u2014 Alert 2026-50, Cisco Catalyst SD-WAN and authentication bypass:<br \/><a href=\"https:\/\/beaconlab.us\/publicacion\/alerta-2026-50-zero-day-en-cisco-catalyst-sd-wan-permite-control-total-del-fabric-via-auth-bypass\/\" target=\"_blank\" rel=\"noopener\">https:\/\/beaconlab.us\/publicacion\/alerta-2026-50-zero-day-en-cisco-catalyst-sd-wan-permite-control-total-del-fabric-via-auth-bypass\/<\/a><\/li>\n<\/ul>\n","protected":false},"featured_media":12284,"template":"","class_list":["post-12288","publicacion","type-publicacion","status-publish","has-post-thumbnail","hentry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"Exploited DoS in Cisco ASA and FTD (CVE-2026-76418) and a new actor using KeyDrift against Cisco SD-WAN. Update to the fixed versions.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Beacon Lab - CSIRT by Cybolt\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"ASA\/FTD: Exploited DoS and new actor targeting Cisco SD-WAN\" \/>\n\t\t<meta property=\"og:description\" content=\"Exploited DoS in Cisco ASA and FTD (CVE-2026-76418) and a new actor using KeyDrift against Cisco SD-WAN. Update to the fixed versions.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-cisco-2026-129-1200x630-1.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-cisco-2026-129-1200x630-1.png\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-29T01:12:31+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-29T01:13:41+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@BeaconLabMX\" \/>\n\t\t<meta name=\"twitter:title\" content=\"ASA\/FTD: Exploited DoS and new actor targeting Cisco SD-WAN\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Exploited DoS in Cisco ASA and FTD (CVE-2026-76418) and a new actor using KeyDrift against Cisco SD-WAN. Update to the fixed versions.\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-cisco-2026-129-1200x630-1.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\\\/#listItem\",\"name\":\"Alert 2026-129 Active exploitation of DoS vulnerability in Cisco ASA and FTD and new threat actor exploiting critical Cisco SD-WAN vulnerability\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\\\/#listItem\",\"position\":2,\"name\":\"Alert 2026-129 Active exploitation of DoS vulnerability in Cisco ASA and FTD and new threat actor exploiting critical Cisco SD-WAN vulnerability\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"name\":\"Home\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"telephone\":\"+528007374357\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.mx\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/BeaconLab_V2-03.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/twitter.com\\\/BeaconLabMX\",\"https:\\\/\\\/www.linkedin.com\\\/showcase\\\/beaconlabmx\"]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\\\/#webpage\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\\\/\",\"name\":\"ASA\\\/FTD: Exploited DoS and new actor targeting Cisco SD-WAN\",\"description\":\"Exploited DoS in Cisco ASA and FTD (CVE-2026-76418) and a new actor using KeyDrift against Cisco SD-WAN. Update to the fixed versions.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\\\/#breadcrumblist\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/cisco-logo-destacada.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\\\/#mainImage\",\"width\":600,\"height\":600},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\\\/#mainImage\"},\"datePublished\":\"2026-10-28T19:12:31-06:00\",\"dateModified\":\"2026-10-28T19:13:41-06:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"ASA\/FTD: Exploited DoS and new actor targeting Cisco SD-WAN","description":"Exploited DoS in Cisco ASA and FTD (CVE-2026-76418) and a new actor using KeyDrift against Cisco SD-WAN. Update to the fixed versions.","canonical_url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BreadcrumbList","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/beaconlab.us\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\/#listItem","name":"Alert 2026-129 Active exploitation of DoS vulnerability in Cisco ASA and FTD and new threat actor exploiting critical Cisco SD-WAN vulnerability"}},{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\/#listItem","position":2,"name":"Alert 2026-129 Active exploitation of DoS vulnerability in Cisco ASA and FTD and new threat actor exploiting critical Cisco SD-WAN vulnerability","previousItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","name":"Home"}}]},{"@type":"Organization","@id":"https:\/\/beaconlab.us\/en\/#organization","name":"Beacon Lab","description":"CSIRT by Cybolt","url":"https:\/\/beaconlab.us\/en\/","telephone":"+528007374357","logo":{"@type":"ImageObject","url":"https:\/\/beaconlab.mx\/wp-content\/uploads\/2023\/12\/BeaconLab_V2-03.png","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\/#organizationLogo"},"image":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\/#organizationLogo"},"sameAs":["https:\/\/twitter.com\/BeaconLabMX","https:\/\/www.linkedin.com\/showcase\/beaconlabmx"]},{"@type":"WebPage","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\/#webpage","url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\/","name":"ASA\/FTD: Exploited DoS and new actor targeting Cisco SD-WAN","description":"Exploited DoS in Cisco ASA and FTD (CVE-2026-76418) and a new actor using KeyDrift against Cisco SD-WAN. Update to the fixed versions.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/beaconlab.us\/en\/#website"},"breadcrumb":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\/#breadcrumblist"},"image":{"@type":"ImageObject","url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/cisco-logo-destacada.png","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\/#mainImage","width":600,"height":600},"primaryImageOfPage":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\/#mainImage"},"datePublished":"2026-10-28T19:12:31-06:00","dateModified":"2026-10-28T19:13:41-06:00"},{"@type":"WebSite","@id":"https:\/\/beaconlab.us\/en\/#website","url":"https:\/\/beaconlab.us\/en\/","name":"Beacon Lab","description":"CSIRT by Cybolt","inLanguage":"en-US","publisher":{"@id":"https:\/\/beaconlab.us\/en\/#organization"}}]},"og:locale":"en_US","og:site_name":"Beacon Lab - CSIRT by Cybolt","og:type":"article","og:title":"ASA\/FTD: Exploited DoS and new actor targeting Cisco SD-WAN","og:description":"Exploited DoS in Cisco ASA and FTD (CVE-2026-76418) and a new actor using KeyDrift against Cisco SD-WAN. Update to the fixed versions.","og:url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\/","og:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-cisco-2026-129-1200x630-1.png","og:image:secure_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-cisco-2026-129-1200x630-1.png","article:published_time":"2026-10-29T01:12:31+00:00","article:modified_time":"2026-10-29T01:13:41+00:00","twitter:card":"summary_large_image","twitter:site":"@BeaconLabMX","twitter:title":"ASA\/FTD: Exploited DoS and new actor targeting Cisco SD-WAN","twitter:description":"Exploited DoS in Cisco ASA and FTD (CVE-2026-76418) and a new actor using KeyDrift against Cisco SD-WAN. Update to the fixed versions.","twitter:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-cisco-2026-129-1200x630-1.png"},"aioseo_meta_data":{"post_id":"12288","title":"ASA\/FTD: Exploited DoS and new actor targeting Cisco SD-WAN","description":"Exploited DoS in Cisco ASA and FTD (CVE-2026-76418) and a new actor using KeyDrift against Cisco SD-WAN. Update to the fixed versions.","keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"custom_image","og_image_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-cisco-2026-129-1200x630-1.png","og_image_width":"0","og_image_height":"0","og_image_custom_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-cisco-2026-129-1200x630-1.png","og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":true,"twitter_card":"default","twitter_image_type":"custom_image","twitter_image_url":null,"twitter_image_custom_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-cisco-2026-129-1200x630-1.png","twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2026-10-29 01:13:42","updated":"2026-10-29 04:49:45","seo_analyzer_scan_date":null,"focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/beaconlab.us\/en\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tAlert 2026-129 Active exploitation of DoS vulnerability in Cisco ASA and FTD and new threat actor exploiting critical Cisco SD-WAN vulnerability\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/beaconlab.us\/en\/"},{"label":"Alert 2026-129 Active exploitation of DoS vulnerability in Cisco ASA and FTD and new threat actor exploiting critical Cisco SD-WAN vulnerability","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-129-active-exploitation-of-dos-vulnerability-in-cisco-asa-and-ftd-and-new-threat-actor-exploiting-critical-cisco-sd-wan-vulnerability\/"}],"_links":{"self":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12288","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion"}],"about":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/types\/publicacion"}],"version-history":[{"count":1,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12288\/revisions"}],"predecessor-version":[{"id":12289,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12288\/revisions\/12289"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media\/12284"}],"wp:attachment":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media?parent=12288"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}