CompTIAAvailable
N10-009
Cisco Firewall Zero-Day Exploited to Crash SSL VPN Devices
Cisco patched CVE-2026-76418, a denial-of-service zero-day in ASA and FTD software that attackers are using to crash firewalls with SSL VPN enabled. Here is who is exposed and what to do today.
Short answer: CVE-2026-76418 lets an unauthenticated remote attacker reload Cisco ASA and FTD firewalls that have SSL VPN (`webvpn`) enabled, and Cisco says it is exploited in the wild. Upgrade to a fixed release. If you cannot patch yet, BleepingComputer reports that disabling secondary authentication on your tunnel groups mitigates it.
Cisco has patched CVE-2026-76418, a high-severity denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software. Attackers are already using it to crash firewalls remotely. If your device has SSL VPN enabled, patch it now.
What happened
Cisco's Product Security Incident Response Team (PSIRT) found evidence of exploitation in October 2026. The company then released security updates. BleepingComputer reported the details on October 29, 2026.
Cisco explains the cause this way: "This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group." An attacker sends a crafted request while connecting to the SSL remote access VPN. The device then reloads unexpectedly.
No login is needed. That is why this bug matters even though it only causes a crash.
Who is affected
You are exposed when both of these are true:
Your ASA or FTD configuration contains the
webvpnkeyword.SSL VPN is enabled on at least one interface.
The trigger involves secondary authentication on a tunnel group. That is why the mitigation below targets it.
BleepingComputer reports that Shadowserver tracks more than 51,000 Cisco ASA SSL VPN devices exposed online. That count does not show how many are already patched or how many are honeypots.
Use this table to triage your own devices:
Your firewall | Exposed to CVE-2026-76418? |
|---|---|
ASA or FTD, | Yes, patch first |
ASA or FTD, | Not by the stated conditions |
ASA or FTD, no SSL VPN configured | Not by the stated conditions |
Worked example: You run an ASA with enable outside under webvpn. Your DefaultWEBVPNGroup uses secondary authentication for a one-time-code check. That device matches the conditions. Schedule the upgrade first, and remove secondary authentication in the meantime if the upgrade must wait.
How serious it is
Cisco rates it high severity, and exploitation in the wild is confirmed. In Cisco's words: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability."
The impact is availability, not data theft. A repeatedly reloading VPN firewall cuts off remote workers and can drop other traffic the device handles. Cisco has shared no indicators of compromise or attacker details. Fixed release numbers are listed in Cisco's advisory.
This is also not Cisco's first firewall problem this year. BleepingComputer reports that in August, Cisco addressed another denial-of-service zero-day, CVE-2026-20349, that crashed ASA and FTD devices with SSL listen sockets enabled. Last year, CVE-2025-20362 and CVE-2025-20333 were exploited against 5500-X Series devices, and CISA issued Emergency Directive 25-03.
What to do now
1. Check your exposure
Run these on each ASA. For FTD, use the equivalent CLI or your management center.
show version | include Version
show running-config webvpn
show running-config tunnel-group | include tunnel-group|secondary-authenticationLook for enable <interface> under webvpn. Then look for secondary-authentication-server-group lines under any tunnel group, including DefaultWEBVPNGroup.
2. Upgrade to a fixed release
Cisco "strongly recommends that customers upgrade to a fixed software release." Take the exact version from Cisco's advisory for your platform. Back up your configuration before the change.
3. Mitigate if you cannot patch today
Cisco provided no workarounds for this issue. BleepingComputer reports that admins who cannot patch right away can mitigate it by disabling secondary authentication on the default DefaultWEBVPNGroup tunnel group or on any user-configured tunnel group. A typical ASA change looks like this. Confirm the syntax on your release first.
configure terminal
tunnel-group DefaultWEBVPNGroup general-attributes
no secondary-authentication-server-groupRepeat for each tunnel group that uses it. This lowers login protection for those groups, so treat it as a short-term step. Restore secondary authentication after you upgrade.
4. Look for signs of crashes
Unexpected reloads are the visible symptom. Check uptime and crash records:
show version | include up
show crashinfoAn uptime far shorter than your last maintenance window deserves a look at your logs.
What learners can take from this
This bug sits in an authentication option, not in exotic code. Reading a firewall config line by line and knowing what each tunnel group does is a core skill for network and security roles. Practice it in a lab: build an ASA or similar VPN, enable and disable features, and note what each one exposes. If you are planning your next step, our Cybersecurity certification page lists the exams that cover VPNs, hardening and incident response. For a similar edge-device story, see our write-up on the Ivanti Connect Secure vulnerability. We also keep a separate note on CVE-2026-76418.
If you buy a voucher from us, the code is emailed within 12 hours and also shown in your account.
Sources
Questions about this topic
Can CVE-2026-76418 be used to take over my firewall?
Cisco describes the impact as a denial-of-service condition in which the device reloads. The advisory language quoted by BleepingComputer does not describe code execution or data access for this bug. Treat it as an availability risk.
Do I need to be logged in to the VPN to trigger the crash?
No. Cisco says unauthenticated, remote attackers can exploit it by sending a crafted request when connecting to the SSL remote access VPN. Any internet-facing SSL VPN interface is therefore a possible entry point.
Is turning off secondary authentication a full fix?
No. Cisco provided no workarounds. BleepingComputer describes disabling secondary authentication as a mitigation for admins who cannot patch right away. You apply it on DefaultWEBVPNGroup and on any user-configured tunnel group, then upgrade to a fixed release.
Is this the same as the ArcaneDoor attacks?
No link to ArcaneDoor has been reported for this flaw. Cisco tied the 2025 zero-days, CVE-2025-20362 and CVE-2025-20333, to that campaign. This one is a separate denial-of-service bug.
How many Cisco flaws has CISA flagged as exploited?
Since November 2021, CISA has flagged 101 Cisco security flaws as exploited in the wild. Seven of them were also abused by ransomware gangs, according to BleepingComputer.
