Cisco Patches Exploited ASA and FTD SSL VPN Zero-Day

Summary

Cisco patched CVE-2026-76418, an exploited flaw in ASA and FTD Remote Access SSL VPN services that lets unauthenticated remote attackers trigger firewall restarts and disrupt availability.

Key points

CVE-2026-76418 has a CVSS score of 8.6 and affects Cisco Secure Firewall ASA and FTD software.
The flaw is in the Remote Access SSL VPN service; a malicious connection request can trigger the affected processing path without a successful VPN login.
Exploitation requires an unpatched release, an internet-reachable SSL VPN login service, and an affected tunnel group configured with secondary authentication.
Cisco learned of in-the-wild exploitation in October but shared no details about the attacks or threat actors.
Cisco released fixes and recommends upgrading. Depending on tunnel-group settings, disabling the tunnel group list or removing secondary authentication can reduce exposure; Cisco warns the latter makes remote access VPN less secure.
Cisco says its Secure Access and Secure Firewall Management Center offerings are not vulnerable.

Article Details

Vulnerability Types: Denial of service through an unexpected device restart
Logic error affecting tunnel groups configured with secondary authentication
Severity: CVSS 8.6
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available
Workarounds: Depending on the default tunnel group's settings, turn off the tunnel group list or remove secondary authentication; Cisco warns that removing secondary authentication makes remote access VPN less secure.