Cisco Patches Actively Exploited ASA and FTD Zero-Day That Crashes SSL VPN Devices
Summary
Cisco says attackers are exploiting CVE-2026-76418 to remotely crash ASA and FTD firewalls with SSL VPN enabled. It released fixes and advises disabling secondary authentication as a mitigation if patching is delayed.
Key points
- CVE-2026-76418 affects Cisco ASA and FTD devices with the webvpn configuration and SSL VPN enabled on an interface.
- An unauthenticated remote attacker can send a crafted request when connecting to SSL remote-access VPN, triggering a device reload and denial of service.
- Cisco says its PSIRT became aware of active exploitation in October 2026; it has not identified targeted organizations or attackers and provided no indicators of compromise.
- Cisco released security updates. For devices that cannot be patched immediately, administrators can mitigate the issue by disabling secondary authentication on the relevant tunnel group.
- Shadowserver tracks more than 51,000 Cisco ASA SSL VPN devices exposed online, but does not say how many are secured or honeypots.
Article Details
- Vulnerability Types
- Denial of service causing affected firewall devices to reload
- Severity
- High
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Disable secondary authentication on the default DefaultWEBVPNGroup tunnel group or on any user-configured tunnel group list.
MITRE ATT&CK
CVE
Vendors
Products
Adaptive Security ApplianceCisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices.Cisco Secure Firewall Threat Defense (FTD) SoftwareCisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices.