GoKawiilCisco patches actively exploited DoS zero-day in ASA, FTD SSL VPN firewalls
Cisco has issued security updates for CVE-2026-76418, a high-severity flaw in ASA and FTD software that lets unauthenticated attackers remotely crash firewalls configured with webvpn and SSL VPN enabled. Cisco's PSIRT confirmed active exploitation in October 2026 but has not disclosed indicators of compromise or details on targeted organizations or attackers. Admins unable to patch immediately can mitigate by disabling secondary authentication on affected tunnel groups.
GoKawiil's interpretation of the reporting above, not reported fact.
With over 51,000 Cisco ASA SSL VPN devices visible online via Shadowserver, unpatched systems could face widespread disruption if exploitation spreads, since the flaw only causes crashes rather than data theft but still knocks remote-access VPNs offline. Cisco's silence on attacker identity and targets leaves defenders without threat intelligence to prioritize response, relying instead on general patching urgency. The repeated targeting of Cisco VPN appliances underscores their continued attractiveness to attackers given their broad enterprise deployment.
- CVE-2026-76418 is a high-severity DoS zero-day affecting Cisco ASA and FTD with webvpn/SSL VPN configurations.
- Cisco confirmed active exploitation in October 2026 but released no indicators of compromise or attacker details.
- A temporary mitigation exists—disabling secondary authentication on tunnel groups—for those who cannot patch immediately.
Source: bleepingcomputer.com, 2026-10-29
Published there as: “New Cisco firewall zero-day exploited to crash SSL VPN devices”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.