Cisco has released patches for an actively exploited vulnerability in its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software, marking the second zero-day targeting these products’ Remote Access SSL VPN service since August.
The flaw, tracked as CVE-2026-76418, carries a CVSS score of 8.6. It stems from logic errors affecting tunnel groups configured with secondary authentication. An unauthenticated attacker can exploit it remotely by sending a malicious request while connecting to the SSL VPN, forcing the device to restart unexpectedly and disrupting availability.
Cisco noted that a successful VPN login is not required to reach the vulnerable processing path. For exploitation to succeed, the firewall must be running an unpatched release, have its SSL VPN login service reachable, and use secondary authentication on an affected tunnel group.
The company’s cloud-delivered firewall and management offerings, Secure Access, and Secure Firewall Management Center are not affected.
Discovery and Mitigation
Cisco’s product security team learned in October that the vulnerability was being exploited in the wild. The issue surfaced during a Cisco TAC support case, and the company credited Eric Fernald with the finding. No details have been released about the attacks or the threat actors involved.
No workarounds exist. Depending on how the default tunnel group is configured, customers can reduce exposure by disabling the tunnel group list or removing secondary authentication. Cisco warned that dropping secondary authentication weakens remote access VPN security and recommends patching instead.
Second Zero-Day Since August
This marks the second ASA/FTD zero-day exploited for denial-of-service attacks in recent months. In August, Cisco patched CVE-2026-20349, an HTTP request processing flaw in the same Remote Access SSL VPN service that also allowed unauthenticated attackers to trigger a device reload remotely.
Cisco has not disclosed attack details for either flaw, and it remains unclear whether the same threat actor is behind both campaigns. Organizations running ASA or FTD with SSL VPN exposed should prioritize patching given the pattern of active exploitation against these services.
