Cisco patches ASA and FTD zero-day attackers used to crash SSL VPN devices
Cisco says it found evidence the flaw was exploited in the wild. Devices with the webvpn keyword and SSL VPN enabled on an interface are affected, and admins who can't patch yet have a mitigation.
Cisco has released security updates for a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are using to remotely crash vulnerable firewall devices, BleepingComputer reported on October 29, 2026.
The flaw, tracked as CVE-2026-76418, affects devices running ASA and FTD software where configurations contain the "webvpn" keyword and SSL VPN is enabled on at least one interface. Cisco said the bug comes from logic errors when secondary authentication is configured on a tunnel group. An unauthenticated, remote attacker can send a crafted request while connecting to the SSL remote access VPN, causing the device to reload.
Cisco's Product Security Incident Response Team said it became aware of active exploitation in October 2026 and strongly recommends upgrading to a fixed release. The company did not share indicators of compromise or say which organizations are being targeted or who is behind the attacks.
Cisco listed no workarounds. Admins who can't patch immediately can mitigate the issue by disabling secondary authentication on the default DefaultWEBVPNGroup tunnel group or on any user-configured tunnel group list.
Shadowserver tracks more than 51,000 Cisco ASA SSL VPN devices exposed online, though it doesn't say how many are secured or are honeypots.
The same report notes Cisco's earlier warning about an actively exploited zero-day in Secure Email Gateway that lets unauthenticated attackers run commands with root privileges.
CVE references
Sources
- New Cisco firewall zero-day exploited to crash SSL VPN devicesPrimarywww.bleepingcomputer.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning