Cisco patches exploited ASA and FTD SSL VPN zero-day
Original title: Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
CVE-2026-76418, CVSS 8.6, lets unauthenticated attackers restart firewalls when secondary authentication is configured.
Cisco released fixes for CVE-2026-76418, a CVSS 8.6 flaw in the Remote Access SSL VPN service of Secure Firewall ASA and Secure Firewall Threat Defense. Unauthenticated attackers can send a malicious request during connection and force an unexpected restart. Exploitation requires an unpatched release, a reachable SSL VPN login service, and secondary authentication on an affected tunnel group. Cisco learned in October that the flaw was exploited in the wild after a TAC case; no attack or actor details were shared. It is the second ASA and FTD SSL VPN denial-of-service zero-day since CVE-2026-20349 in August.
Unconfirmed: Cisco has not identified the attackers or said whether the same actor exploited CVE-2026-20349.
- A successful VPN login is not required to reach the affected processing path.
- Secure Access, cloud firewall offerings, and Secure Firewall Management Center are not vulnerable.
- No workarounds exist; exposure can be reduced by disabling the tunnel group list or secondary authentication.
- Cisco credited Eric Fernald and said it is unclear if both zero-days share an actor.
Impact: Unauthenticated remote denial of service via device restart
| Product | Affected |
|---|---|
| Cisco Secure Firewall Adaptive Security Appliance | unpatched releases with SSL VPN and secondary authentication |
| Cisco Secure Firewall Threat Defense | unpatched releases with SSL VPN and secondary authentication |
- 1.Upgrade ASA and FTD to the fixed releases Cisco published.
- 2.If upgrade is delayed, turn off the tunnel group list or remove secondary authentication, noting Cisco says the latter weakens VPN security.
- CVEs
- CVE-2026-76418
- Vendors
- Cisco
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76418 | Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth | 8.6 | <1% | KEV | KEV |
From the original article
1 min read at securityweek.com
Cisco on Wednesday released fixes for an exploited vulnerability affecting its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Tracked as CVE-2026-76418 and assigned a CVSS score of 8. 6, the bug resides in the Remote Access SSL VPN service.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.