Security updates have been issued by Cisco to address a denial-of-service zero-day vulnerability present in its Adaptive Security Appliance (ASA) and Threat Defense (FTD) software, which threat actors are currently leveraging to cause remote crashes of susceptible firewall hardware.
This high-severity issue, identified as CVE-2026-76418, impacts devices running ASA or FTD software provided their configurations contain the 'webvpn' keyword and SSL VPN functionality is active on at least one interface. An unauthenticated attacker who successfully exploits this weakness can initiate a denial-of-service (DoS) event, leading to the device spontaneously restarting.
The Product Security Incident Response Team (PSIRT) at Cisco identified evidence of this vulnerability being actively used in real-world attacks earlier this month, prompting the company to issue the necessary patches. However, the firm has refrained from releasing any indicators of compromise and has not shared supplementary details regarding the attacks, such as the identity of the organizations under attack or the actors responsible for the exploitation.
Cisco explained that "This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group." Furthermore, the organization stated, "An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition." The company strongly advises that clients apply the fixed software release to resolve this security gap, noting that "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability."
Although Cisco has not furnished any workarounds to counteract this security problem, system administrators who are unable to immediately apply the patch for CVE-2026-76418 possess the option to mitigate the risk by deactivating secondary authentication on the standard DefaultWEBVPNGroup tunnel group or any tunnel group list that has been customized by a user.
Internet monitoring platform Shadowserver currently monitors over 51,000 Cisco ASA SSL VPN devices accessible online, though this data does not specify how many of these devices have been secured or if they are acting as honeypots.
This incident follows prior security events; last year, Cisco addressed two other vulnerabilities (CVE-2025-20362 and CVE-2025-20333) in ASA and FTD firewall devices during September, warning customers that attackers had exploited these flaws in zero-day assaults targeting 5500-X Series equipment with VPN web services enabled. On the same day, the US Cybersecurity and Infrastructure Security Agency (CISA) mandated that federal agencies secure their Cisco firewall hardware within a 24-hour window via Emergency Directive 25-03.
Cisco previously linked those earlier attacks to the ArcaneDoor campaign, which had been exploiting two other zero-days (CVE-2024-20353 and CVE-2024-20359) to penetrate governmental networks since November 2023. More recently, in August, Cisco dealt with another denial-of-service zero-day vulnerability (CVE-2026-20349) that was being actively exploited in the field to crash ASA and FTD firewall devices possessing SSL listen sockets enabled. Earlier this month, the company also cautioned customers to patch a zero-day vulnerability (CVE-2026-76519) in its Secure Email Gateway (SEG) security solution, which permits unauthenticated attackers to remotely execute commands with root privileges.
CISA has flagged 101 Cisco security flaws as being exploited in the wild since November 2021, seven of which have also been utilized by ransomware groups. The Blue Report 2026 evaluates defensive capabilities on a technique-by-technique basis across 338 million simulations conducted within customer production environments, indicating that overall prevention scores may obscure the subsequent actions taken by adversaries. Furthermore, CISA advises federal entities to ensure that all actively exploited Cisco flaws are fully patched.
These ongoing instances of zero-day exploitation across infrastructure components highlight a persistent challenge in maintaining robust security posture, particularly when vulnerabilities allow for remote, unauthenticated access leading to service disruption.
The repeated disclosure of actively exploited vulnerabilities across network perimeter devices and security gateways underscores a continuous operational pressure on platform security teams to manage exposure against sophisticated threat actors.
Why it matters
This vulnerability presents a critical denial-of-service risk to network infrastructure, directly impacting platform availability. Operators must prioritize patching to prevent remote disruption of essential firewall services. This incident highlights the ongoing threat of actively exploited zero-days in core security appliances.
