Cisco Patches ASA/FTD VPN Zero-Day, Active Attacks

Cisco confirmed active exploitation of CVE-2026-76418 and shipped patches for it on October 29. The flaw carries a CVSS score of 8.6 and sits in the Remote Access SSL VPN service of both Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software.

If you run Cisco ASA or FTD with SSL VPN and secondary authentication enabled on any tunnel group, this is your top patching priority today.

What the vulnerability does

The bug is a logic error in how secondary authentication is handled inside tunnel groups. An unauthenticated, remote attacker can send a crafted request during the SSL VPN connection handshake to trigger an unexpected device reload. That’s a hard crash and an outage, not a data breach: the attacker takes your firewall offline and keeps it there as long as they keep sending requests.

Cisco’s own advisory notes that “a successful VPN login is not required to reach the affected processing path,” which widens the exposure. The default tunnel group, DefaultWEBVPNGroup, is in scope if it uses secondary authentication.

Cisco’s cloud-delivered Secure Access, Secure Firewall Management Center, and the cloud-managed firewall offering are not affected.

Who is exposed

Three conditions have to hold:

1. The device runs a vulnerable ASA or FTD release.
2. The SSL VPN login service is reachable from the network.
3. Secondary authentication is configured on at least one tunnel group, including the default DefaultWEBVPNGroup.

Shadowserver tracked more than 51,000 Cisco ASA SSL VPN endpoints exposed to the internet as of October 29, per BleepingComputer’s reporting. Not all of those will have secondary authentication configured, but the number illustrates the scale of the attack surface.

Patches

Cisco released fixes across both product lines on October 29:

ASA Software

• 9.16 and earlier: upgrade to 9.16.4.104
• 9.18: upgrade to 9.18.4.96
• 9.20: upgrade to 9.20.4.50
• 9.22: upgrade to 9.22.3.200
• 9.23: upgrade to 9.23.1.48
• 9.24: upgrade to 9.24.1.27 or 9.24.10.1

FTD Software

• 7.0 and earlier: upgrade to 7.0.11
• 7.2: upgrade to 7.2.13
• 7.4: upgrade to 7.4.9
• 7.6: upgrade to 7.6.7
• 7.7: upgrade to 7.7.14
• 10.0: upgrade to 10.0.3
• 10.1: upgrade to 10.1.1

FTD managed through Cisco Secure FMC or Secure FDM: review your deployed remote access VPN policy and the resulting device running configuration to confirm whether secondary authentication is in use.

If you can’t patch immediately

Cisco does not offer a full workaround. The options for exposure reduction are:

• If DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel group list.
• Remove secondary authentication from user-configured tunnel groups or from DefaultWEBVPNGroup.

Cisco explicitly cautions that removing secondary authentication makes remote access VPN less secure. These are temporary measures; upgrade to a fixed release as soon as you can.

Context: second ASA/FTD VPN zero-day since August

This is the second actively exploited DoS vulnerability in the same service in roughly three months. In August, Cisco patched CVE-2026-20349, another unauthenticated remote reload flaw in the ASA/FTD SSL VPN service, which CISA added to its Known Exploited Vulnerabilities catalog and ordered federal agencies to address within 72 hours.

Cisco has not shared attribution, indicators of compromise, or details about scale for either attack campaign. It’s not known whether the same threat actor is responsible for both.

The pace of exploited Cisco firewall flaws is worth tracking. Since August alone, Cisco has patched the Secure Email Gateway under zero-day attack, five critical RCEs in NX-OS, and 34 CVEs across its product line in a single October bundle. If Cisco network gear sits on your perimeter, this is a sustained, active threat environment, not a series of isolated events.

Bottom line: Patch CVE-2026-76418 today. If patching is delayed, confirm whether secondary authentication is active on DefaultWEBVPNGroup and act on Cisco’s exposure-reduction steps in the interim.