Cisco has released patches for a denial-of-service zero-day in the Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software that runs many corporate firewalls, warning that attackers are actively exploiting the flaw to remotely crash vulnerable devices. The vulnerability, tracked as CVE-2026-76418 and rated 8.6 out of 10 in severity, lets an unauthenticated attacker send a single crafted request to a firewall's SSL VPN service and force the device to reload, knocking remote access offline for every employee who depends on it.
The flaw sits in how ASA and FTD handle secondary authentication on VPN tunnel groups — the extra login step many organizations layer on top of a username and password. A firewall is only exposed if it has SSL VPN enabled and configured with that secondary authentication; devices without VPN turned on, or without the extra authentication step, are not affected. Cisco's own security team first became aware of exploitation this month.
In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.
Cisco security advisory
Cisco has not published indicators of compromise or said which organizations have been targeted, leaving defenders with little to go on beyond the advisory itself. BleepingComputer's reporting notes that the only mitigation Cisco has offered short of patching is disabling secondary authentication on the affected tunnel groups — a step that weakens login security precisely to stop a crash, a trade-off many security teams will be reluctant to make.
The Second Such Flaw Since August
The U.S. Cybersecurity and Infrastructure Security Agency added the bug to its Known Exploited Vulnerabilities catalog on October 29, a designation that requires federal civilian agencies to patch on a short deadline. SecurityWeek points out that this is the second Cisco firewall VPN zero-day exploited in the wild since August, part of a run of attacks this year targeting the remote-access VPN features exposed directly to the internet. Shadowserver, which scans the public internet for vulnerable systems, counts more than 51,000 Cisco ASA devices with SSL VPN still reachable online.
Fixed versions are available across every supported ASA release line, including 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200 and 9.24.1.27, with FTD fixes listed in Cisco's own advisory. Security teams running either platform with SSL VPN enabled are being urged to check their version against that list immediately, given that exploitation is already underway.
