Cisco has released security updates to patch a denial-of-service zero-day vulnerability, tracked as CVE-2026-76418, that attackers are actively exploiting to remotely crash vulnerable Adaptive Security Appliance (ASA) and Threat Defense (FTD) firewall devices.
Tracked as CVE-2026-76418, the high-severity vulnerability affects devices running ASA and FTD software with configurations containing the 'webvpn' keyword and SSL VPN enabled on at least one interface. Successful exploitation allows an unauthenticated, remote attacker to trigger a denial-of-service condition, causing the device to reload unexpectedly.
Cisco said the vulnerability "is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition."
Cisco's Product Security Incident Response Team (PSIRT) discovered evidence that the flaw was being exploited in the wild earlier this month. The company strongly recommends that customers upgrade to a fixed software release, although it did not provide indicators of compromise or share details on which organizations are being targeted or who is carrying out the attacks.
Cisco provided no workarounds that address the issue, but administrators who cannot immediately patch can mitigate it by disabling secondary authentication on the default DefaultWEBVPNGroup tunnel group or on any user-configured tunnel group list.
The advisory is the latest in a series of zero-day vulnerabilities affecting Cisco's firewall products. Last year, Cisco patched two other actively exploited flaws (CVE-2025-20362 and CVE-2025-20333). Cisco linked the attacks to the ArcaneDoor campaign, which had been exploiting zero-days since November 2023. The US Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive the same day, ordering federal agencies to secure their Cisco firewalls within 24 hours. More recently, in August, Cisco addressed another denial-of-service zero-day (CVE-2026-20349) that was actively exploited to crash devices with SSL listen sockets enabled. Earlier this month, it warned customers to patch an actively exploited zero-day in its Secure Email Gateway (SEG) solution.
Internet monitoring platform Shadowserver tracks over 51,000 Cisco ASA SSL VPN devices exposed online. Overall, CISA has flagged 101 Cisco security flaws as exploited in the wild since November 2021, seven of which were abused by ransomware gangs.
Analysis
Why This Matters
- The active exploitation of a high-severity flaw in widely deployed VPN firewalls exposes enterprise and government networks to immediate denial-of-service attacks that can disrupt critical operations.
- With no workaround available, administrators face a race to patch, a challenge compounded by the 51,000 systems tracked as exposed online.
- The lack of shared indicators of compromise from Cisco makes it harder for the wider security community to detect attacks related to this vulnerability.
Background
Cisco ASA and FTD are widely used network security platforms providing firewall and VPN services. The company has faced a persistent wave of zero-day exploits targeting its firewall products over the past year, drawing repeated warnings and emergency directives from US cybersecurity authorities.
What to Watch
- Whether CISA issues a new emergency directive requiring federal agencies to patch this vulnerability within a tight deadline.
- The speed of patch adoption among the 51,000 internet-exposed Cisco ASA devices tracked by Shadowserver.
- Whether the active exploitation is linked to state-sponsored groups known for targeting network devices, such as those behind the ArcaneDoor campaign.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedCisco patched an actively exploited zero-day that could remotely crash VPN firewalls.BleepingComputer: “Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices.”
- SupportedThe high-severity denial-of-service flaw affects ASA and FTD devices with SSL VPN enabled, and exploitation is active.BleepingComputer: “this high-severity vulnerability affects devices running ASA and FTD software with configurations containing the 'webvpn' keyword and SSL VPN enabled on at least one interface.”
- SupportedCVE-2026-76418 affects ASA and FTD devices configured with the 'webvpn' keyword and SSL VPN enabled on at least one interface.BleepingComputer: “Tracked as CVE-2026-76418 , this high-severity vulnerability affects devices running ASA and FTD software with configurations containing the 'webvpn' keyword and SSL VPN enabled on at least one interface.”
- SupportedAn unauthenticated remote attacker can trigger a denial-of-service condition that causes an affected device to reload unexpectedly.BleepingComputer: “Successful exploitation allows unauthenticated, remote attackers to trigger a denial-of-service (DoS) condition, causing the device to reload unexpectedly.”
- SupportedCisco said the flaw is due to logic errors involving secondary authentication on a tunnel group, and that a crafted request could cause the device to reload.BleepingComputer: “This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN.”
- SupportedCisco's PSIRT discovered evidence of exploitation in the wild earlier this month.BleepingComputer: “Cisco advised customers to patch vulnerable firewalls after its Product Security Incident Response Team (PSIRT) discovered evidence that the flaw was being exploited in the wild earlier this month.”
- SupportedCisco strongly recommends that customers upgrade to a fixed software release.BleepingComputer: “Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.”
- SupportedCisco provided no workarounds, but administrators unable to patch immediately can mitigate the flaw by disabling secondary authentication on the specified tunnel groups.BleepingComputer: “While Cisco provided no workarounds that address this security issue, admins who can't immediately patch CVE-2026-76418 can mitigate it by disabling secondary authentication on the default DefaultWEBVPNGroup tunnel group or on any user-configured tunnel group list.”
- SupportedCisco had not provided indicators of compromise or details about targeted organizations or who was exploiting the flaw.BleepingComputer: “However, the company didn't provide indicators of compromise and hasn't shared additional information about the attacks, including which organizations are being targeted or who is exploiting the flaw.”
- Partly supportedCISA issued an emergency directive the same day, ordering federal agencies to secure their Cisco firewalls within 24 hours.BleepingComputer: “Last year, Cisco patched two other flaws (CVE-2025-20362 and CVE-2025-20333) affecting ASA and FTD firewall devices in September and cautioned customers that attackers had exploited them in zero-day attacks targeting 5500-X Series devices with VPN web services enabled. The same day, the US Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 25-03 , ordering federal agencies to secure their Cisco firewall devices within 24 hours.”
- SupportedShadowserver tracks over 51,000 Cisco ASA SSL VPN devices exposed online.BleepingComputer: “Currently, Internet monitoring platform Shadowserver tracks more than 51,000 Cisco ASA SSL VPN devices exposed online”
- SupportedSince November 2021, CISA has flagged 101 Cisco flaws as exploited in the wild, seven of which were abused by ransomware gangs.BleepingComputer: “Since November 2021, CISA has flagged 101 Cisco security flaws as exploited in the wild, seven of which were also abused by ransomware gangs.”