Cisco Patches Actively Exploited Zero-Day That Crashes ASA and FTD Firewalls

Cisco has released security updates to address a denial-of-service zero-day vulnerability in its Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are actively exploiting to remotely crash vulnerable firewall devices. The flaw, tracked as CVE-2026-76418, is rated high severity and affects devices running ASA or FTD software where the configuration contains the 'webvpn' keyword and SSL VPN is enabled on at least one interface. Cisco said the issue stems from logic errors when secondary authentication is configured on a tunnel group. An attacker can trigger the vulnerability by sending a crafted request while connecting to the SSL remote access VPN, causing the affected device to reload unexpectedly and creating a denial-of-service condition. The company's Product Security Incident Response Team (PSIRT) became aware of active exploitation of the flaw in October 2026. Cisco has strongly recommended that customers upgrade to a fixed software release. The company has not provided indicators of compromise or additional details about the attacks, including which organizations are being targeted or who is behind the exploitation. Cisco did not offer workarounds that fully address the issue. However, administrators who cannot patch immediately can mitigate the risk by disabling secondary authentication on the default DefaultWEBVPNGroup tunnel group or on any user-configured tunnel group list. The exposure is significant. Internet monitoring platform Shadowserver currently tracks more than 51,000 Cisco ASA SSL VPN devices exposed online, though it does not break down how many have been secured or how many are honeypots. The flaw is the latest in a series of actively exploited Cisco vulnerabilities. Last September, Cisco patched two other flaws affecting ASA and FTD devices, CVE-2025-20362 and CVE-2025-20333, and warned that attackers had used them in zero-day attacks against 5500-X Series devices with VPN web services enabled. The same day, the US Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 25-03, ordering federal agencies to secure their Cisco firewall devices within 24 hours. Cisco linked those attacks to the ArcaneDoor campaign, which had been exploiting two additional zero-days, CVE-2024-20353 and CVE-2024-20359, to breach government networks since November 2023. More recently, in August, Cisco addressed another denial-of-service zero-day, CVE-2026-20349, that attackers were exploiting to crash ASA and FTD devices with SSL listen sockets enabled. Earlier this month, Cisco also urged customers to patch an actively exploited zero-day, CVE-2026-76519, in its Secure Email Gateway (SEG) security solution, which allows unauthenticated attackers to execute commands remotely with root privileges. According to CISA, 101 Cisco security flaws have been flagged as exploited in the wild since November 2021, seven of which have also been abused by ransomware gangs.