New Cisco firewall zero-day exploited to crash SSL VPN devices

Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices.

Tracked as CVE-2026-76418, this high-severity vulnerability affects devices running ASA and FTD software with configurations containing the 'webvpn' keyword and SSL VPN enabled on at least one interface.

Successful exploitation allows unauthenticated, remote attackers to trigger a denial-of-service (DoS) condition, causing the device to reload unexpectedly.

Cisco advised customers to patch vulnerable firewalls after its Product Security Incident Response Team (PSIRT) discovered evidence that the flaw was being exploited in the wild earlier this month. However, the company didn't provide indicators of compromise and hasn't shared additional information about the attacks, including which organizations are being targeted or who is exploiting the flaw.

"This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition," Cisco said.

"In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability."

While Cisco provided no workarounds that address this security issue, admins who can't immediately patch CVE-2026-76418 can mitigate it by disabling secondary authentication on the default DefaultWEBVPNGroup tunnel group or on any user-configured tunnel group list.

Currently, Internet monitoring platform Shadowserver tracks more than 51,000 Cisco ASA SSL VPN devices exposed online, but doesn't provide information on how many have already been secured or are honeypots.

Internet-exposed Cisco ASA SSL VPN devices (Shadowserver)

​Last year, Cisco patched two other flaws (CVE-2025-20362 and CVE-2025-20333) affecting ASA and FTD firewall devices in September and cautioned customers that attackers had exploited them in zero-day attacks targeting 5500-X Series devices with VPN web services enabled.

The same day, the US Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 25-03, ordering federal agencies to secure their Cisco firewall devices within 24 hours.

Cisco linked the attacks to the ArcaneDoor campaign, which had also been exploiting two other zero-days (CVE-2024-20353 and CVE-2024-20359) to breach government networks since November 2023.

More recently, in August, Cisco addressed another denial-of-service zero-day vulnerability (CVE-2026-20349) that attackers were actively exploiting in the wild to crash affected ASA and FTD firewall devices with SSL listen sockets enabled.

Earlier this month, it also warned customers to patch an actively exploited zero-day (CVE-2026-76519) in its Secure Email Gateway (SEG) security solution that lets unauthenticated attackers execute commands remotely with root privileges.

Since November 2021, CISA has flagged 101 Cisco security flaws as exploited in the wild, seven of which were also abused by ransomware gangs.