Attackers are actively exploiting a newly disclosed flaw in Cisco firewalls, and if your practice has one at the office, this is a threat that may require direct action on your part.
A firewall at your office is equipment protecting your network, and keeping it updated is part of your practice's security, whether you manage it yourself or through an IT company. It is your responsibility to ensure that it is patched to keep your office from being vulnerable to attacks.
The threat: a VPN flaw that can knock remote access offline
MS-ISAC has issued an advisory on CVE-2026-76418, a vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. It is already being exploited.
An attacker needs no password. By sending a specially crafted request to the firewall's SSL remote-access VPN, on setups with secondary authentication configured, they can force the device to restart unexpectedly. The result is a denial of service that cuts off remote access.
For a practice, that could mean:
- Doctors and billing staff working from home suddenly lose access to the EHR.
- Satellite offices that connect through the VPN go dark.
- Repeated attacks keep systems unstable, delaying care and claims.
Cisco has released fixed software and strongly recommends upgrading. There is no workaround; a temporary mitigation exists, but updating is the real fix.
What to ask your IT provider this week
Do not assume your IT company has already addressed the problem. Contact them promptly and ask:
1. Does our office use a Cisco ASA or FTD firewall for remote access, and is it affected?
2. Have the security updates or other corrective measures been applied?
3. Is there any evidence our network has already been compromised?
4. Can you send written confirmation of the steps you took, and when?
That last question matters. Written documentation protects your practice if regulators or patients ever ask what you did once the threat was known.
Why this is a HIPAA issue
The HIPAA Security Rule requires practices to protect not only the confidentiality of electronic patient information but also its availability. A firewall that attackers can repeatedly knock offline threatens both your access to patient records and the security of your network.
HIPAA also requires a regular risk analysis and reasonable steps to reduce the risks you find. A known, actively exploited flaw in your own equipment is exactly the kind of risk regulators expect you to address. Keeping a record of what was checked, patched and confirmed shows a good-faith compliance program if a problem ever arises.
Get help keeping your practice protected
TLD Systems helps medical practices turn security alerts like this one into a clear, documented compliance plan. The program was built by Dr. Brody, a practicing podiatrist and the company's CEO, who knows firsthand how hard it is to keep up with regulations while caring for patients.
The Comprehensive HIPAA Compliance Program follows a three-step roadmap:
1. Risk Analysis: identify the physical, technical and administrative safeguards already in place, including the equipment protecting your office network.
2. Risk Mitigation Plan: use TLD Systems' customized risk rankings to pinpoint your office's biggest risks and reduce the chance of a patient data breach.
3. Maintain a Culture of Compliance: keep an up-to-date HIPAA manual and trained staff, so you are prepared if a breach ever occurs.
The program includes:
- HIPAA training for doctors and staff
- A customized HIPAA manual
- A practice-specific Notice of Privacy Practices
- Business Associate Agreement forms and tracking
- Annual risk analysis completion
- OSHA bloodborne pathogen training
Our hands-on customer service keeps you on track, so you can remove the regulatory speed bumps and focus on what matters most: patient care.
Contact TLD Systems today to learn more or sign up for the HIPAA Compliance Program.
- Call: 631-403-6687
- Email: info@TLDSystems.com
- Visit: www.TLDSystems.com
Vulnerability details are based on an advisory from MS-ISAC. This article is for general information and is not legal advice.
Read Comments