Cisco has released security updates for CVE-2026-76418, a high-severity vulnerability (CVSS 8.6) in Secure Firewall ASA and FTD software that, according to the company, is already being exploited by attackers. The vulnerability allows an unauthenticated remote attacker to trigger a firewall reboot via a specially crafted request to the remote-access SSL VPN service, resulting in a denial of service. At the same time, Cisco Talos disclosed the activity of the APT group tracked as UAT-11473, which has been exploiting the critical vulnerability CVE-2026-20127 (CVSS 10.0) in Cisco SD-WAN to deploy a specialized malicious framework called KeyDrift. Administrators of Cisco ASA/FTD with SSL VPN enabled and secondary authentication configured need to immediately install the updates or apply temporary mitigation measures.
CVE-2026-76418: technical essence and exploitation conditions
According to the Cisco security advisory published on October 28, 2026, the vulnerability is caused by logical errors in the handling of requests when secondary authentication is configured in a tunnel group configuration. An attacker sends a specially crafted request when connecting to the remote-access SSL VPN service, which triggers an unexpected device reboot. Critically important: successful VPN authentication is not required to exploit the vulnerability — it is enough for the SSL VPN service to be accessible from the outside.
A device is vulnerable if all three of the following conditions are met:
- A vulnerable version of Cisco Secure Firewall ASA or FTD is installed
- The remote-access SSL VPN service is reachable from the network
- Secondary authentication is configured within the scope of a tunnel group
Cisco highlights a non-obvious nuance: even if the tunnel-group-list enable parameter is disabled with the no tunnel-group-list enable command, the device remains vulnerable if the default group DefaultWEBVPNGroup uses secondary authentication. Administrators should check the secondary-authentication-server-group parameter in all tunnel groups, including DefaultWEBVPNGroup.
Cisco reports that PSIRT learned about active exploitation of CVE-2026-76418 in October 2026, but details about the attackers, the scale of the campaign, and specific victims have not been disclosed. No independent confirmation of exploitation had been found at the time of publication.
Fixed versions and temporary measures
Updates are available for the following branches:
Cisco Secure Firewall ASA:
- 9.16 and earlier — fixed in 9.16.4.104
- 9.18 — fixed in 9.18.4.96
- 9.20 — fixed in 9.20.4.50
- 9.22 — fixed in 9.22.3.200
- 9.23 — fixed in 9.23.1.48
- 9.24 — fixed in 9.24.1.27 and 9.24.10.1
Cisco Secure FTD:
- 7.0 and earlier — fixed in 7.0.11
- 7.2 — fixed in 7.2.13
- 7.4 — fixed in 7.4.9
- 7.6 — fixed in 7.6.7
- 7.7 — fixed in 7.7.14
- 10.0 — fixed in 10.0.3
- 10.1 — fixed in 10.1.1
Cisco notes that there is no full workaround for CVE-2026-76418. As a temporary measure until updating, it is recommended to disable the tunnel group list if DefaultWEBVPNGroup does not use secondary authentication, or disable secondary authentication on affected tunnel groups. The company warns that these measures reduce the security level of the remote-access VPN and should be regarded as temporary.
UAT-11473 and the KeyDrift framework: APT campaign against SD-WAN
In parallel with releasing the patch for CVE-2026-76418, Cisco disclosed information about the activity of the APT group tracked as UAT-11473. According to a Cisco Talos report, the group exploited CVE-2026-20127, a critical authentication bypass vulnerability (CVSS 10.0, CWE-287) in Cisco Catalyst SD-WAN Controller, Manager, and Validator. This vulnerability, registered in the NVD and added to the CISA KEV catalog back on February 25, 2026, affects all deployment types — both on-premises and Cisco-hosted cloud — regardless of device configuration. We have already written about vulnerabilities in Cisco SD-WAN, and the current disclosure confirms the sustained interest of advanced groups in this infrastructure.
After successfully exploiting CVE-2026-20127, the attackers installed a specialized malicious framework KeyDrift, consisting of several components, including PolyFlame and LittleFilch. According to Talos, the framework operates directly within SD-WAN control-plane processes and is capable of:
- Intercepting decrypted control traffic
- Extracting control-session metadata and data-plane key material
- Preparing and transmitting collected data using encrypted records
Talos notes that in the analyzed PolyFlame samples, no hard-coded IP addresses, callback domains, URLs, or binding ports were found. This significantly complicates detection based on network indicators of compromise and makes process and control-plane telemetry the key surface for detection.
Talos mapped KeyDrift activity to MITRE ATT&CK techniques: T1055.008 (process injection), T1574.006 (load order hijacking), T1040 (network traffic capture), T1573.001 (encrypted channel), T1027.002 (obfuscation), T1497.001 (sandbox detection), and others.
Attribution and targeted sectors
According to Talos, UAT-11473 targets organizations in the space and satellite services sector, defense and aerospace technologies, as well as policy research. Talos assesses with high confidence that UAT-11473’s infrastructure significantly overlaps with the Silent Train covert access network associated with the Volt Typhoon group. It should be emphasized: this is an assessment of infrastructure overlap, not proof that the two groups are identical. No independent confirmation of this attribution has been found in the available materials.
Impact assessment
The combination of the two disclosed issues creates a serious threat landscape for organizations using Cisco network infrastructure. CVE-2026-76418 presents a direct threat to availability for any organization with ASA/FTD-based SSL VPN and secondary authentication — a typical configuration for enterprises with elevated security requirements for remote access. The fact that authentication is not required for exploitation makes the attack trivially accessible.
CVE-2026-20127 poses a strategic threat: a complete authentication bypass in SD-WAN controllers opens the way to compromising the entire software-defined network, and the KeyDrift framework enables long-term covert presence with automated exfiltration of cryptographic material.
Recommendations
For CVE-2026-76418: immediately update ASA and FTD to fixed versions. If updating is not possible within the next few hours, disable secondary authentication on affected tunnel groups as a temporary measure, understanding that this reduces the security level of the VPN. Check the DefaultWEBVPNGroup configuration for the secondary-authentication-server-group parameter.
For CVE-2026-20127: update Cisco Catalyst SD-WAN to corrected versions (20.9.8.2, 20.12.5.3/20.12.6.1, 20.15.4.2, or 20.18.2.1 depending on the branch). Given the nature of KeyDrift — operating inside control-plane processes without network indicators — prioritize monitoring for anomalies in SD-WAN processes and the control plane. Organizations in targeted sectors (space, defense, aerospace technologies) should conduct a retrospective review of activity on SD-WAN controllers.
Both vulnerabilities are being actively exploited, and updating cannot be postponed. For CVE-2026-76418, the priority is protecting the availability of VPN infrastructure within the next few hours; for CVE-2026-20127, it is verifying the integrity of SD-WAN controllers and searching for traces of KeyDrift, especially if updating was delayed since the initial disclosure in February 2026.
