Cisco firewall zero-day lets attackers crash SSL VPN devices

Cisco released security updates to fix a denial-of-service zero-day in its Adaptive Security Appliance and Threat Defense software that attackers are using to crash vulnerable firewall devices, according to BleepingComputer. The flaw is tracked as CVE-2026-76418 and affects ASA and FTD devices with configurations that include the "webvpn" keyword and have SSL VPN enabled on at least one interface.

What the vulnerability does and how it is being used

According to BleepingComputer, an attacker can exploit logic errors that occur when secondary authentication is configured on a tunnel group. By sending a crafted request when connecting to the SSL remote access VPN, an unauthenticated remote attacker could cause the affected device to reload, creating a denial-of-service condition. Cisco PSIRT told BleepingComputer that it discovered evidence this bug was being exploited in the wild earlier this month.

Cisco has not shared indicators of compromise, nor has it said which organizations are being targeted or who is exploiting the flaw, BleepingComputer reports. SecurityWeek also covered the active exploitation, describing this as the second exploited Cisco firewall VPN zero-day since August.

Shadowserver, an Internet monitoring platform cited by BleepingComputer, currently tracks more than 51,000 Cisco ASA SSL VPN devices exposed online. That number does not say how many of those are patched, secured, or honeypots, but it indicates a sizable population of reachable devices.

Who and what is affected

The issue affects ASA and FTD devices when two conditions are met: the configuration contains the "webvpn" keyword and SSL VPN is enabled on at least one interface. The vulnerability is tied to how secondary authentication is handled on tunnel groups, including the default DefaultWEBVPNGroup or any user-configured tunnel group list, BleepingComputer reports.

This is not an isolated incident. BleepingComputer notes Cisco patched other ASA and FTD flaws last year and earlier this year that were also exploited in the wild. Cisco previously linked a set of related attacks to the ArcaneDoor campaign and has addressed other actively exploited zero-days in its firewall and email gateway products.

Practical steps to reduce your risk

If you run Cisco ASA or FTD devices with SSL VPN enabled, take these steps now, following the guidance Cisco published and reported by BleepingComputer and SecurityWeek:

• Apply Cisco's security updates for ASA and FTD as soon as you can, to install the fixed software release for CVE-2026-76418. Cisco's PSIRT "strongly recommends" upgrading to a fixed release, BleepingComputer reports.
• If you cannot patch immediately, disable secondary authentication on the DefaultWEBVPNGroup tunnel group or on any user-configured tunnel group list, as Cisco suggested to mitigate the issue.
• Review which devices have SSL VPN enabled and the specific tunnel group configurations that use secondary authentication, and document those instances so you can target fixes and mitigations.
• Limit exposure of SSL VPN interfaces to only the IPs and networks that need access, and consider temporary access restrictions at the network edge while you apply patches.
• Monitor vendor advisories and your firewall logs for unexpected reloads or service interruptions, and coordinate any incidence response with your IT or security partners.

If you want a quick external check of your site perimeter, start with a free external scan at our security page: /security.html.

Why this matters for small businesses, nonprofits, and public sector teams

Even though this is a denial-of-service bug rather than a data-stealing exploit, a forced reload of a perimeter firewall or VPN gateway can interrupt remote access and critical services. BleepingComputer's reporting shows that attackers are actively exploiting this class of flaw, and the large number of Internet-exposed ASA SSL VPN devices tracked by Shadowserver means unpatched systems may be reachable.

For organizations that rely on remote VPN access, a reload of an SSL VPN appliance can disrupt staff, contractors, or service providers who need remote connections to systems. For public sector teams and nonprofits with limited IT staff, unplanned outages can be harder to contain and recover from.

What to watch next

Watch for further Cisco advisories and any published indicators of compromise. BleepingComputer noted Cisco did not provide such indicators with this advisory, so vendors, monitoring services, or incident responders may publish detections after further investigation. Also watch for related reports if attackers try to chain this denial-of-service issue with credential theft or other exploits that might follow a service interruption.

Finally, treat this as a reminder to keep network perimeter devices on an update cadence and to have mitigation options documented for critical services. The immediate priority is to apply the Cisco fixes or the temporary mitigation that disables secondary authentication on affected tunnel groups, as described above, and to monitor for any signs of attempted exploitation.