Cisco on Wednesday released fixes for an exploited vulnerability affecting its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software.
Tracked as CVE-2026-76418 and assigned a CVSS score of 8.6, the bug resides in the Remote Access SSL VPN service. Attackers can exploit it remotely, without authenticating, to force the device to restart unexpectedly and disrupt its availability.
Cisco attributes the issue to logic errors affecting tunnel groups configured with secondary authentication. Exploitation involves a malicious request sent while connecting to the SSL VPN.
“A successful VPN login is not required to reach the affected processing path,” Cisco noted.
For an attack to work, the firewall must be running an unpatched release, have its SSL VPN login service reachable, and use secondary authentication in an affected tunnel group. The company’s cloud-delivered firewall and management offerings, Secure Access, and the Secure Firewall Management Center are not vulnerable.
Cisco’s product security team learned in October that the flaw was being exploited in the wild. No information has been shared about the attacks or the threat actors behind them.
The vulnerability came to light during a Cisco TAC support case, and the company credited Eric Fernald with finding it.
No workarounds are available. Depending on the default tunnel group’s settings, customers can reduce their exposure by turning off the tunnel group list or removing secondary authentication. Cisco cautioned that dropping secondary authentication makes remote access VPN less secure, and it recommends upgrading instead.
This is the second ASA and FTD zero-day exploited for DoS attacks in recent months. In August, Cisco released fixes for CVE-2026-20349, an HTTP request processing flaw that also lets unauthenticated attackers remotely trigger a reload through the Remote Access SSL VPN service.
Cisco did not disclose details on those attacks either. It’s unclear whether both flaws were exploited by the same threat actor.
Related: Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Related: Hackers Start Probing Fresh Oracle EBS Vulnerability
Related: China-Linked Hackers Exploit PHP2Shell to Root Firewalls
