Cisco Secure Firewall 0-Day Vulnerability Exploited in the Wild to Crash SSL VPN Devices

Cisco released security updates for actively exploited CVE-2026-76418, a flaw in Secure Firewall ASA and FTD software that lets unauthenticated remote attackers force device restarts, causing denial of service and disrupting remote access.

The high-severity vulnerability carries a CVSS score of 8.6. Cisco published its security advisory on October 28, 2026, after its Product Security Incident Response Team learned of active exploitation during October. Eric Fernald discovered the issue while resolving a Cisco Technical Assistance Center support case.

The flaw stems from logic errors in the Remote Access SSL VPN service when secondary authentication is configured on a tunnel group. An attacker can send a crafted request while connecting to the VPN service and trigger an unexpected device reload. A successful VPN login is not required to reach the affected processing path.

Cisco’s advisory confirms a denial-of-service issue causing device restarts and service disruptions, but identifies no attackers or victims and reports no confirmed data theft or remote code execution.

Cisco Secure Firewall 0-Day

The issue follows earlier Cisco firewall VPN crash attacks involving CVE-2026-20349. It is also separate from the previously reported Cisco ASA zero-day code execution vulnerability, CVE-2025-20333. These flaws have different causes and should not be treated as interchangeable.

Exposure requires vulnerable ASA or FTD software, a reachable SSL remote access VPN login service, and secondary authentication within the relevant tunnel group configuration.

Administrators should check for webvpn enabled on an interface and inspect tunnel groups for secondary-authentication-server-group.

When tunnel-group-list enable is configured, checks must cover all tunnel groups, including DefaultWEBVPNGroup, not just profiles shown on the login page.

Removing the group list does not eliminate exposure if the default group still uses secondary authentication. Secure FMC, Cloud-delivered Firewall, cloud-delivered FMC, and Secure Access are not affected.

Fixed ASA releases include 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, and 9.23.1.48. Cisco also lists 9.24.1.27 and 9.24.10.1. Fixed FTD releases include 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1. Administrators should select the appropriate release for their software branch.

Cisco lists no workaround but provides temporary mitigation guidance based on tunnel group settings. Turning off the group list may help when the default group lacks secondary authentication.

Otherwise, removing secondary authentication lowers VPN security and requires careful review. Cisco strongly recommends patching and using its Software Checker to confirm which releases are exposed and to identify suitable fixed software before planning upgrades.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Cisco Secure Firewall 0-Day Vulnerability Exploited in the Wild to Crash SSL VPN Devices appeared first on Cyber Security News.