Skip to content
Hacker Posts

Cisco patches exploited ASA/FTD SSL VPN zero-day (CVE-2026-76418)

An unauthenticated attacker can crash Cisco ASA and FTD firewalls through the Remote Access SSL VPN. Cisco found in-the-wild exploitation in October; patch now.

Published 3 min read
cveciscoftdadvisory

Cisco has patched a denial-of-service zero-day in Secure Firewall ASA and Threat Defense (FTD) software that attackers are already using to knock vulnerable firewalls offline. CVE-2026-76418 lets an unauthenticated, remote attacker send a crafted request to the Remote Access SSL VPN and force the device to reload. Cisco's PSIRT says it found evidence of exploitation in the wild earlier this month. If you terminate remote-access VPN on ASA or FTD, this is a patch-now item.

What's affected

The flaw is in the Remote Access SSL VPN service. Cisco traces it to "logic errors when secondary authentication is configured on a tunnel group." A device is exposed if SSL VPN is enabled on at least one interface — in practice, the webvpn keyword is present in the running configuration. Both ASA and FTD are affected; the IKEv2 and clientless paths are not the trigger here, the SSL remote-access path is.

CVSS is 8.6. Successful exploitation is a reload loop: the attacker repeats the request, the firewall reboots, remote workers lose their tunnel each time.

Exploitation status

Cisco states it "became aware of active exploitation" of CVE-2026-76418 in October 2026. It has not named a threat actor, given a start date, or quantified the scale, and no public proof-of-concept had surfaced at disclosure. There is no separate researcher report confirming the campaign — the exploitation claim rests on Cisco's own advisory, which is the primary source here.

Action checklist

  1. Upgrade to a fixed release now. Cisco lists, among others: ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27/9.24.10.1; FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1. Match your train against Cisco's advisory before scheduling.
  2. If you can't patch immediately and DefaultWEBVPNGroup does not use secondary authentication, turn off the tunnel-group list as Cisco's interim mitigation.
  3. Otherwise disable secondary authentication on any user-configured tunnel-group list, or on the default tunnel group, per Cisco's workaround — then plan the upgrade.
  4. Check whether SSL VPN is actually needed on internet-facing interfaces; show running-config | include webvpn tells you your exposure.
  5. Watch for unexplained device reloads in syslog as a crude indicator of attempts.

Context

Cisco ASA and FTD remote-access VPN has been a standing target: CISA has flagged more than 100 Cisco flaws as exploited since 2021, and ASA SSL VPN specifically has drawn repeated DoS and auth-bypass bugs this year. A crash-only flaw looks less alarming than RCE until you remember the device being crashed is the thing standing between your remote workforce and the internet. Treat availability of the VPN head-end as the asset under attack, not a side effect.

Related stories