Cisco patched an actively exploited flaw in its Secure Firewall ASA and Firepower Threat Defense software on October 28, and Philips told customers four days later that none of its products carry the bug. CVE-2026-76418 lets an unauthenticated attacker force an affected firewall to reload by sending a crafted request to the SSL VPN login service, and CISA added it to the Known Exploited Vulnerabilities catalog on October 29 with a November 1 deadline for federal civilian agencies, a three day window.
The flaw sits in how ASA and FTD handle secondary authentication on a VPN tunnel group. Cisco rates it CVSS 8.6 and says the issue is a logic error rather than a missing check: a device running a vulnerable release with the SSL VPN login service reachable from outside the network and secondary authentication configured on a tunnel group can be knocked offline by a single crafted request, no credentials required. Cisco also warns that the default group, DefaultWEBVPNGroup, stays exposed even when an administrator disables the tunnel group list, as long as that group itself uses secondary authentication.
Fixed builds are version specific. ASA branches get 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and either 9.24.1.27 or 9.24.10.1 depending on train. FTD branches get 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, or 10.1.1. Cisco says there is no workaround short of the update, though disabling secondary authentication on the default and any user configured tunnel group buys time until a maintenance window opens.
Philips published its notice on November 2, saying it is monitoring the Cisco advisory and that no Philips products are known to be impacted, with its security team continuing to evaluate the matter. The appliance carries no Philips code, but it often sits at the network edge in front of Philips systems anyway, carrying remote clinician and vendor VPN sessions into hospital networks that also run Philips imaging, monitoring, and informatics platforms.
A denial of service bug that only knocks a VPN offline reads as a lesser problem next to a breach, but a manufacturer that cannot reach a device over VPN cannot push an emergency patch or support a remote service call either. The fix here is a firmware update to the firewall itself, not to any medical device behind it, which is exactly the chain regulatory affairs teams now have to track: a vendor advisory for hardware nobody in the hospital thinks of as a medical device.
This is the fourth time since September that a widely used remote access appliance has landed on CISA's exploited list with a near immediate deadline, after two Citrix NetScaler flaws, a BeyondTrust Remote Support bug, and an Ivanti Connect Secure zero day. Each time, device manufacturers with no stake in the affected product still had to check their own exposure and tell customers what they found, because the appliance sits between a clinical network and the internet whether or not any manufacturer wrote a line of its code.