Cisco Secure Firewall 0-Day Vulnerability Exploited in the Wild to Crash SSL VPN Devices

What happened?

Cisco released security updates for actively exploited CVE-2026-76418, a flaw in Secure Firewall ASA and FTD software that lets unauthenticated remote attackers force device restarts, causing denial of service and disrupting remote access. The high-severity vulnerability carries a CVSS score of 8.6. Cisco published its security advisory on October 28, 2026, after its Product Security Incident Response Team learned of active exploitation during October. Eric Fernald discovered the issue while resolving a Cisco Technical Assistance Center support case.

Key details

• Cisco released security updates for CVE-2026-76418, a high-severity flaw actively exploited in October 2026.
• The vulnerability affects Secure Firewall ASA and FTD software, allowing unauthenticated remote attackers to force device restarts.
• The flaw stems from logic errors in the Remote Access SSL VPN service when secondary authentication is configured on a tunnel group.
• A successful VPN login is not required to reach the affected processing path and trigger a device reload.
• Cisco confirms denial-of-service causing device restarts and service disruptions, with no confirmed data theft or remote code execution.
• Exposure requires vulnerable ASA or FTD software, a reachable SSL remote access VPN login service, and secondary authentication within the tunnel group configuration.
• Secure FMC, Cloud-delivered Firewall, cloud-delivered FMC, and Secure Access are not affected by this vulnerability.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.