Cisco ASA and FTD SSL VPN zero-day crashed firewalls in attacks
Original title: New Cisco firewall zero-day exploited to crash SSL VPN devices
Unauthenticated attackers can reload devices that have webvpn and SSL VPN enabled; Cisco found exploitation in October 2026.
Cisco patched CVE-2026-76418, a high-severity denial-of-service flaw in Adaptive Security Appliance and Threat Defense software. It affects devices whose configuration contains the webvpn keyword and that have SSL VPN enabled on at least one interface. Logic errors when secondary authentication is set on a tunnel group let an unauthenticated remote attacker send a crafted SSL VPN request and force a reload. Cisco’s PSIRT found active exploitation in October 2026 and recommends a fixed release. Disabling secondary authentication on DefaultWEBVPNGroup or other tunnel groups is a mitigation, not a fix. Shadowserver tracks more than 51,000 exposed Cisco ASA SSL VPN devices but not how many are patched.
Unconfirmed: Cisco has not identified the attacker, targeted organizations, or how many exposed devices are vulnerable.
- CVE-2026-76418 causes an unexpected reload and a denial-of-service condition.
- Cisco gave no indicators of compromise, targets, or attacker identity.
- No workaround fully addresses the flaw; secondary authentication can be disabled as mitigation.
- Shadowserver sees more than 51,000 Cisco ASA SSL VPN devices exposed online.
Impact: Unauthenticated remote denial of service via device reload
| Product | Affected |
|---|---|
| Cisco Adaptive Security Appliance | configurations containing webvpn with SSL VPN enabled |
| Cisco Threat Defense | configurations containing webvpn with SSL VPN enabled |
- 1.Upgrade vulnerable ASA and FTD firewalls to a fixed software release.
- 2.If patching is delayed, disable secondary authentication on affected tunnel groups.
- CVEs
- CVE-2026-76418
- Vendors
- Cisco
- Organizations
- Shadowserver
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76418 | Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth | 8.6 | <1% | KEV | KEV |
From the original article
2 min read at bleepingcomputer.com
Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.