Cisco patches actively exploited zero-day in ASA and FTD firewalls

Cisco has released security updates for a zero-day vulnerability in its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. Attackers are already exploiting the flaw to crash firewall devices remotely.

The vulnerability

The bug is tracked as CVE-2026-76418 and rated high severity. It affects devices running ASA and FTD whose configuration contains the webvpn keyword and that have SSL VPN enabled on at least one interface.

According to Cisco, the cause is logic errors that occur when secondary authentication is configured on a tunnel group. An attacker can send a crafted request while connecting to the SSL remote access VPN. The device then reloads unexpectedly, resulting in a denial-of-service (DoS) condition. No authentication is required.

Attacks and recommendations

Cisco's Product Security Incident Response Team (PSIRT) found evidence of in-the-wild exploitation in October 2026. The company strongly recommends upgrading to a fixed software release. It has not published indicators of compromise, nor has it said who is behind the attacks or which organizations are being targeted.

Cisco offers no official workarounds. However, admins who cannot patch right away can reduce the risk by disabling secondary authentication on the default DefaultWEBVPNGroup tunnel group and on any user-configured tunnel groups.

According to the Shadowserver monitoring platform, more than 51,000 Cisco ASA SSL VPN devices are exposed online. How many of them are already secured, and how many are honeypots, is unknown.

Not the first time

In September last year, Cisco fixed two ASA and FTD flaws (CVE-2025-20362 and CVE-2025-20333) that had been exploited as zero-days against 5500-X Series devices with VPN web services enabled. The same day, the US Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 25-03, ordering federal agencies to secure their Cisco firewalls within 24 hours. Cisco tied those attacks to the ArcaneDoor campaign, which since November 2023 had also used two other zero-days (CVE-2024-20353 and CVE-2024-20359) to breach government networks.

In August, the company addressed another exploited DoS zero-day (CVE-2026-20349) in ASA and FTD devices with SSL listen sockets enabled. And earlier this month, Cisco warned of an actively exploited flaw, CVE-2026-76519, in Secure Email Gateway that lets unauthenticated attackers execute commands remotely with root privileges.

Since November 2021, CISA has flagged 101 Cisco vulnerabilities as exploited in the wild. Seven of them were also abused by ransomware gangs.

Source: Bleeping Computer