Cisco has issued security updates addressing a denial-of-service zero-day affecting its Adaptive Security Appliance (ASA) and Threat Defense (FTD) platforms. Evidence shows that threat actors are already leveraging this flaw to remotely reboot vulnerable firewall deployments.
Designated as CVE-2026-76418 and rated high-severity, the vulnerability impacts ASA and FTD installations where the webvpn keyword appears in configuration files and SSL VPN is active on at least one network interface. Unauthenticated attackers can send specially crafted requests to trigger an unexpected device reload, resulting in service disruption.
Cisco's Product Security Incident Response Team (PSIRT) identified active exploitation of this flaw in the wild during October 2026. The vendor has urged customers to upgrade to patched software versions but has not disclosed indicators of compromise or details about targeted organizations and threat actors involved.
This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Cisco
In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.
Cisco
Cisco has not released workarounds for the vulnerability itself. However, administrators unable to deploy patches immediately can reduce exposure by disabling secondary authentication on the DefaultWEBVPNGroup tunnel group or on any custom tunnel group configurations.
Internet monitoring firm Shadowserver has identified more than 51,000 Cisco ASA SSL VPN devices accessible from the public internet, though the count does not distinguish between patched systems, unpatched targets, or honeypots.
Pattern of Active Cisco Firewall Exploitation
This disclosure continues a troubling pattern of zero-day activity targeting Cisco firewall infrastructure. In September 2025, Cisco patched two additional flaws (CVE-2025-20362 and CVE-2025-20333) in ASA and FTD devices after confirming that attackers had weaponized them against 5500-X Series appliances running VPN web services. On the same day, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 25-03, mandating that federal agencies secure their Cisco firewall deployments within 24 hours.
Cisco attributed those attacks to the ArcaneDoor campaign, which had previously exploited two other zero-days (CVE-2024-20353 and CVE-2024-20359) to penetrate government networks beginning in November 2023.
In August 2026, Cisco addressed a separate denial-of-service zero-day (CVE-2026-20349) that was being actively exploited to crash ASA and FTD devices configured with SSL listen sockets. Earlier this month, the company also warned of an actively exploited zero-day (CVE-2026-76519) in its Secure Email Gateway (SEG) platform that permits unauthenticated remote command execution with root-level access.
Since November 2021, CISA has documented 101 Cisco security vulnerabilities that have been exploited in active attacks. Of these, seven were also leveraged by ransomware operations.