Cisco Patches Zero-Day Used to Crash SSL VPN Firewalls

Cisco released security updates for a high-severity denial-of-service vulnerability in its Adaptive Security Appliance (ASA) and Threat Defense (FTD) software. Attackers have exploited the flaw to make vulnerable firewall devices reload remotely.

Tracked as CVE-2026-76418, the vulnerability affects devices with configurations containing the “webvpn” keyword and SSL VPN enabled on at least one interface. Cisco said the flaw stems from logic errors when secondary authentication is configured on a tunnel group. An unauthenticated remote attacker can send a crafted request while connecting to the SSL remote access VPN, causing the device to reload and creating a denial-of-service condition.

Cisco’s Product Security Incident Response Team discovered evidence of active exploitation in October 2026. The company has not shared indicators of compromise or details about targeted organizations or the attackers. Cisco recommends upgrading to a fixed software release. It provided no workaround, but says disabling secondary authentication on the default DefaultWEBVPNGroup tunnel group or on a user-configured tunnel group list can mitigate the issue for administrators unable to patch immediately.

Shadowserver tracks more than 51,000 Cisco ASA SSL VPN devices exposed online. The figure does not indicate how many are patched or are honeypots, according to the source.