Cisco has released security updates to fix a high-severity zero-day vulnerability in its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software that attackers are actively exploiting to crash vulnerable firewall devices remotely.
Tracked as CVE-2026-76418, the flaw can let unauthenticated attackers trigger a denial-of-service (DoS) condition, forcing affected firewalls to reload unexpectedly. The vulnerability poses a risk to organizations that rely on Cisco firewalls to secure their networks and provide remote access to employees.
According to Cisco’s security advisory, the flaw results from logic errors involving secondary authentication configured on a tunnel group. An attacker can exploit it by sending a specially crafted request while connecting to an SSL remote-access VPN service. Successful exploitation can crash the affected device, potentially interrupting network connectivity and preventing legitimate users from accessing remote services.
The vulnerability affects Cisco ASA and FTD devices that have the webvpn keyword in their configuration and SSL VPN enabled on at least one interface. However, exploitation also depends on the specific authentication and tunnel-group configuration, so not every device running the affected software is necessarily vulnerable.
Cisco’s Product Security Incident Response Team (PSIRT) discovered evidence of active exploitation in October 2026. The company has urged customers to upgrade to a fixed software release as soon as possible. Cisco has not publicly identified the attackers, disclosed which organizations have been targeted, or provided indicators of compromise that administrators can use to detect related activity.
Cisco has published fixes for multiple ASA and FTD software releases. Administrators should check the official advisory to identify the correct update for their particular software version and deployment. The company says there is no workaround that directly resolves CVE-2026-76418, making installation of a fixed release the recommended solution.
Organizations that cannot immediately upgrade should review their VPN configurations and follow Cisco’s official guidance while preparing to deploy the security update. Administrators should also monitor firewall availability and investigate unexpected device reloads that could indicate exploitation or other operational issues.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The latest Cisco firewall zero-day adds to a series of security vulnerabilities affecting the company’s network security products. In August 2026, Cisco addressed another actively exploited denial-of-service flaw, CVE-2026-20349, affecting ASA and FTD VPN services.
Cisco Patches Actively Exploited ASA and FTD Firewall Zero-Day Vulnerability
