Cisco patches another firewall zero-day as attackers crash SSL VPNs in the wild

Key points

• Cisco disclosed CVE-2026-76418 on 28 October 2026, a high-severity flaw (CVSS 8.6) in ASA and FTD firewalls that unauthenticated attackers are already using to crash devices.
• CISA added the bug to its Known Exploited Vulnerabilities catalogue on 29 October 2026, with a federal patch deadline of 1 November 2026.
• Shadowserver counts more than 51,000 Cisco ASA SSL VPN appliances reachable from the open internet.
• The flaw is a logic error triggered only when secondary authentication is configured on a tunnel group, and there is no workaround beyond patching or disabling that setting.
• This is the fourth actively exploited ASA/FTD bug Cisco has shipped a fix for in roughly 14 months, after CVE-2025-20333, CVE-2025-20362 and CVE-2026-20349.

Cisco has pushed out an emergency fix for a flaw in its firewalls that strangers on the internet are using to knock the devices offline.

The bug is tracked as CVE-2026-76418 and carries a CVSS score of 8.6. It sits in the Remote Access SSL VPN service, the part of a Cisco firewall that lets staff log in from home. A VPN, or virtual private network, is the encrypted tunnel a laptop uses to reach the office network.

An attacker does not need a password. They send one specially shaped request to the login page and the firewall reboots. Do it in a loop and the firewall stays down, which means nobody at the company can get in either. That is a denial of service, in plain words: the machine is too busy falling over to do its job.

Who is affected?

Any organisation running Cisco Secure Firewall ASA or FTD software with the webvpn keyword in its configuration and SSL VPN enabled on at least one interface. Cisco's own Product Security Incident Response Team found evidence of exploitation in October and told customers to upgrade immediately. The advisory lists no workaround that fully fixes the issue, though disabling secondary authentication on the DefaultWEBVPNGroup tunnel group blocks the specific trigger.

Secondary authentication is the second password or token prompt some firms layer on top of the first login. The logic error lives in that code path. Which is awkward, because secondary authentication is a security feature, and shops that turned it on were trying to do the right thing.

First reported by BleepingComputer, the disclosure landed with no indicators of compromise and no attribution. Cisco has not said who is behind the attacks or which sectors are being hit.

How bad is the exposure?

Shadowserver, an internet scanning non-profit, counts more than 51,000 Cisco ASA SSL VPN appliances facing the public internet. Not all of them are vulnerable, and some will be honeypots set up to study attackers, but the pool of targets is large.

CISA, the US cyber agency, moved fast. It added the bug to its Known Exploited Vulnerabilities list on 29 October 2026 and gave federal agencies until 1 November 2026 to patch. That is a 72-hour window, which is unusually tight even by CISA standards.

The pattern here matters

Cisco's ASA and FTD line has become one of the most reliably exploited edge products in enterprise IT. A quick count from CISA's catalogue:

The September 2025 pair was tied to the ArcaneDoor espionage campaign, which Cisco has been tracking since late 2023. On 5 November 2025, Cisco added an update to the CVE-2025-20333 advisory warning of a new attack variant that reboots unpatched boxes. That one is a CVSS 9.9 remote code execution flaw, meaning an attacker with VPN credentials could run commands as root.

My read: the latest bug is "only" a denial of service, so defenders will be tempted to deprioritise it behind this quarter's patch queue. That would be a mistake. A reliable crash of your remote access gateway is a reliable outage of your workforce, and the same researchers poking at the DoS path are the ones who found the September 2025 RCE chain. Patch, then audit whether your firewall's management plane really needs to be reachable from the whole internet. Since November 2021, CISA has flagged 101 Cisco bugs as exploited in the wild. The vendor is not going to stop shipping advisories, and the devices are not getting less exposed on their own.