Cisco has released security updates to fix a high-severity zero-day vulnerability in its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. Attackers are exploiting the flaw to remotely crash vulnerable firewall devices.
Tracked as CVE-2026-76418, the vulnerability can trigger a denial-of-service (DoS) condition. The vulnerability exists due to a logic error when secondary authentication is configured on a tunnel group. A remote attacker can send specially crafted request when connecting to the SSL remote access VPN and perform a denial of service attack.
Cisco has not disclosed indicators of compromise, targeted organizations, or details about the attackers. Administrators are strongly recommended to apply the available security updates and review firewall configurations.
In a separate report, Cisco Talos detailed attacks exploiting CVE-2026-20127, a critical authentication-bypass vulnerability in Cisco Catalyst SD-WAN control systems. The flaw allows unauthenticated remote attackers to gain administrative privileges on affected systems.
Talos linked the attacks to UAT-11473, a threat group that deployed custom malware named KeyDrift. The malware is designed to collect cryptographic keys used to encrypt traffic between network sites and store them for later use.
The group has targeted organizations in the space and satellite, defense, aerospace, and policy research sectors. Talos also observed infrastructure overlap with Volt Typhoon’s Silent Train covert access network designed to gain and maintain access to the technologies businesses rely on to manage devices, networks and critical operations.
Volt Typhoon is a China-linked state-backed threat actor focused on infiltrating operational technology (OT) and IT networks to pre-position for potential sabotage.
According to a recent Black Lotus Labs’ report, the group has been using the Silent Train framework, which relies on chains of compromised devices to hide attack origins and maintain access to high-value targets.
The group has exploited at least four zero-day vulnerabilities, including CVE-2026-16812, CVE-2026-20127, CVE-2025-8875, CVE-2025-8876, and CVE-2024-39717, affecting VeloCloud Orchestrator, Cisco Catalyst SD-WAN, N-able N-central, and Versa Director.
The attacks target telecommunications, government, defense, utilities, and other critical sectors, enabling credential theft, data exfiltration, and persistent remote access. The framework is continuously updated, with compromised routers and other devices used as relay points to evade detection and potentially access downstream organizations.