Cisco Firewall Zero-Day Under Attack: Hackers Exploit SSL VPN Flaw to Crash ASA and FTD Devices

Summary

Cisco has disclosed CVE-2026-76418, a high-severity denial-of-service (DoS) vulnerability affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The vulnerability carries a CVSS score of 8.6 and could allow an unauthenticated, remote attacker to force vulnerable firewall devices to reload unexpectedly, disrupting network security services and SSL VPN connectivity. The flaw exists in the Remote Access SSL VPN service due to logic errors when secondary authentication is configured on a tunnel group. Cisco confirmed that the vulnerability is being actively exploited in the wild in October 2026. Security updates have been released to address the issue, and organizations should prioritize upgrading affected firewall installations to fixed software releases.

Vulnerability Details

CVE ID	Severity	EPSS Score	Vulnerability Type
CVE-2026-76418	High	0.57 %	Denial of Service (DoS)

Technical Detail

CVE-2026-76418 is caused by logic errors in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software when secondary authentication is configured on a tunnel group. An unauthenticated, remote attacker can exploit the vulnerability by sending a specially crafted request while connecting to the SSL remote access VPN service.

Successful exploitation can trigger an unexpected reload of the affected firewall device, resulting in a denial-of-service (DoS) condition. This can interrupt network traffic passing through the firewall and disrupt remote access VPN connectivity while the device recovers. Repeated exploitation could potentially cause recurring service interruptions and affect the availability of network resources protected by the firewall.

The vulnerability does not require valid credentials or a successful VPN login. Cisco confirms that a successful VPN login is not required to reach the affected processing path. Consequently, an unauthenticated attacker with network access to the exposed SSL remote access VPN service can trigger the vulnerable functionality.

Exploitation depends on multiple configuration conditions. A device is vulnerable when all the following conditions are met:

• 1. It runs a vulnerable release of Cisco Secure Firewall ASA Software or Cisco Secure FTD Software.
• 2. The SSL remote access VPN login service is reachable. The running configuration contains the webvpn keyword, and SSL VPN is enabled on at least one interface
• 3. Secondary authentication is configured within the applicable tunnel group scope.

The vulnerability can affect multiple tunnel groups depending on the remote access VPN configuration. When tunnel-group-list enable is configured, secondary authentication settings across all tunnel groups are relevant, including the default tunnel group, DefaultWEBVPNGroup. This also applies to tunnel groups that are not displayed in the connection profile list on the VPN login page.

When tunnel-group-list enable is absent or has been removed using the no tunnel-group-list enable command, the default tunnel group, DefaultWEBVPNGroup, remains relevant. If secondary authentication is configured on this group, disabling the tunnel group list does not eliminate exposure.

Affected Versions

Product	Affected Versions	Fixed Version
Cisco Secure Firewall ASA Software	9.16 and earlier	9.16.4.104
	9.18	9.18.4.96
	9.20	9.20.4.50
	9.22	9.22.3.200
	9.23	9.23.1.48
	9.24	9.24.1.27 or 9.24.10.1
Cisco Secure FTD Software	7.0 and earlier	7.0.11
	7.2	7.2.13
	7.4	7.4.9
	7.6	7.6.7
	7.7	7.7.14
	10.0	10.0.3
	10.1	10.1.1

Note: The fixed release depends on the installed software branch. Administrators should verify their software version and deployment configuration against the official advisory.

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic ID	Tactic
T1190	Exploit Public-Facing Application	TA0001	Initial Access
T1499.004	Endpoint Denial of Service: Application or System Exploitation	TA0040	Impact

Mitigation and Recommendations

• 1. Apply security updates: Upgrade affected Cisco Secure Firewall ASA and FTD installations to the appropriate fixed software releases provided in the security advisory. Prioritize internet-facing firewalls and devices providing remote access VPN services.
• 2. Review SSL VPN configuration: Inspect the running configuration for the webvpn keyword and verify whether SSL remote access VPN is enabled on any interface. Review the tunnel group configuration for the secondary-authentication-server-group setting, including the default DefaultWEBVPNGroup.
• 3. Temporarily disable secondary authentication where appropriate: If immediate patching is not possible, Cisco recommends disabling secondary authentication on affected user-configured tunnel groups or the default tunnel group. Depending on the configuration, administrators may also disable the tunnel group list using the no tunnel-group-list enable command. Evaluate the operational and security implications before applying these changes.
• 4. Review remote access exposure: Identify internet-accessible SSL VPN interfaces and restrict access to trusted networks or authorized source addresses wherever operationally feasible. Reducing unnecessary exposure can help limit opportunities for exploitation.
• 5. Verify remediation: After upgrading or applying temporary mitigation, verify the running software release and tunnel group configuration. Continue monitoring firewall stability and VPN availability for suspicious activity.