Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August

What it is

CVE-2026-76418 (CVSS 8.6) is an exploited denial-of-service flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD). Cisco released fixes on Wednesday 28 October 2026. Its product security team learned of in-the-wild exploitation in October 2026. Cisco has shared nothing about the attacks or the actors behind them.

How it works

Cisco attributes the bug to logic errors in tunnel groups configured with secondary authentication. The attacker sends a malicious request while connecting to the SSL VPN, and the device restarts unexpectedly. Cisco says: "A successful VPN login is not required to reach the affected processing path." The attack therefore needs no credentials.

Preconditions / Affected

All three conditions must hold:

flowchart LR
    A[Unpatched ASA/FTD release] --> D[Device reload possible]
    B[SSL VPN login service reachable] --> D
    C[Secondary auth in an affected tunnel group] --> D

Cisco states that its cloud-delivered firewall and management offerings, Secure Access, and Secure Firewall Management Center are not vulnerable. The page gives no fixed version numbers.

What to do

Upgrade to a fixed ASA or FTD release. Cisco recommends this over any configuration change, and it says no workarounds exist.

Exposure can be reduced, depending on the default tunnel group's settings, by either of two changes:

• Turn off the tunnel group list.
• Remove secondary authentication.

Cisco warns that removing secondary authentication makes remote access VPN less secure.

Caveats

This is the second ASA/FTD zero-day exploited for DoS in recent months. CVE-2026-20349, fixed in August 2026, is an HTTP request processing flaw that also lets unauthenticated attackers trigger a reload through the Remote Access SSL VPN service. Cisco has not said whether one actor is behind both. The page offers no indicators of compromise or detection guidance. The flaw surfaced during a Cisco TAC support case, and Cisco credited Eric Fernald with the find.