Skip to content

Back to the catalog

New Cisco firewall zero-day exploited to crash SSL VPN devices
bleepingcomputer.comarticle

New Cisco firewall zero-day exploited to crash SSL VPN devices

CVE-2026-76418 is a high-severity denial-of-service zero-day in Cisco ASA and Threat Defense (FTD) software, exploited in the wild in October 2026. Unauthenticated attackers send a crafted request to the SSL VPN (webvpn) when secondary authentication is set on a tunnel group, causing a device reload. Cisco offers no workaround besides disabling secondary authentication on tunnel groups. Shadowserver sees over 51,000 exposed ASA SSL VPN devices.

TL;DR Cisco patches an actively exploited ASA/FTD SSL VPN zero-day that lets unauthenticated attackers crash firewalls, with a partial mitigation for unpatched devices.
Open original ↗
Document

What it is

CVE-2026-76418 is a high-severity denial-of-service flaw in Cisco ASA and Threat Defense (FTD) software. Cisco's PSIRT learned of exploitation in the wild in October 2026 and has released fixed software. The page gives no fixed version numbers.

How it works

Cisco attributes the bug to "logic errors when secondary authentication is configured on a tunnel group." An unauthenticated remote attacker sends a crafted request while connecting to the SSL remote access VPN. The device reloads, which causes the DoS.

Preconditions / Affected

  • The configuration contains the webvpn keyword.
  • SSL VPN is enabled on at least one interface.
  • Per Cisco's description, a tunnel group has secondary authentication configured.

Shadowserver counts more than 51,000 Cisco ASA SSL VPN devices exposed online. It does not say how many are already patched or are honeypots.

What to do

Upgrade to a fixed software release, which Cisco "strongly recommends." Cisco lists no workaround that fully addresses the flaw. Admins who cannot patch right away can reduce exposure by disabling secondary authentication on the default DefaultWEBVPNGroup tunnel group and on any user-configured tunnel group. The page gives no commands for this.

Check whether your devices combine webvpn, an SSL VPN-enabled interface and secondary authentication. Unexpected reloads on such devices are the only symptom the page describes.

Caveats

Cisco has published no indicators of compromise. It has not said who is being targeted or who is exploiting the flaw, so detection guidance is limited to watching for unexplained reloads.

The same product line has had other recent exploited bugs, which the page lists:

  • CVE-2026-20349, another ASA/FTD DoS zero-day with SSL listen sockets enabled, patched in August 2026.
  • CVE-2026-76519, a root remote command execution flaw in Secure Email Gateway, warned about in October 2026.
  • CVE-2025-20362 and CVE-2025-20333, ASA/FTD zero-days from September 2025. They led to CISA Emergency Directive 25-03 and were tied to the ArcaneDoor campaign.

Organisations named here

  • ArcaneDoor
  • CISA
  • Cisco PSIRT
  • Emergency Directive 25-03

CVEs named here

  • CVE-2026-76418
  • CVE-2025-20362
  • CVE-2025-20333
  • CVE-2024-20353
  • CVE-2024-20359
  • CVE-2026-20349
  • CVE-2026-76519

Technologies named here

  • Shadowserver
  • Cisco Secure Email Gateway
  • VPN
  • CISA Emergency Directive 25-03
  • Cisco ASA
  • Cisco Firepower Threat Defense
  • Cisco PSIRT
  • The Blue Report 2026

Techniques named here

  • Denial of service
  • Denial of service via crafted SSL VPN request
  • Zero-day exploitation of firewall devices

Threat actors named here

  • ArcaneDoor campaign (exploited CVE-2024-20353 and CVE-2024-20359 as zero-days to breach government networks since November 2023; Cisco linked the 2025 attacks on CVE-2025-20362 and CVE-2025-20333 to it)

Related in Threat Intel