Cisco fixes exploited VPN flaw that can crash firewalls

Cisco has issued fixes for an exploited vulnerability in its Secure Firewall ASA and FTD products, tracked as CVE-2026-76418 with a CVSS of 8.6. The flaw lies in the Remote Access SSL VPN service and can be triggered remotely without authentication to force a device restart and disrupt availability. Cisco says the issue stems from logic errors affecting tunnel groups configured with secondary authentication, with an attack involving a malicious request during SSL VPN connection. A successful VPN login is not required to reach the affected processing path.

Exposure requires the firewall to be running an unpatched release, its SSL VPN login service reachable, and the presence of secondary authentication in the affected tunnel group; Secure Access and the Secure Firewall Management Center are not vulnerable. Cisco learned in October that the flaw was being exploited in the wild, though no details about the attackers or campaigns have been disclosed. The company credits Eric Fernald with the discovery, and notes there are no official workarounds.

In the absence of mitigations, Cisco suggests reducing exposure by disabling the tunnel group list or removing secondary authentication, but warns this would weaken remote access security and urges upgrading instead. This marks the second ASA/FTD zero-day in recent months used to trigger DoS through the Remote Access SSL VPN, following CVE-2026-20349 disclosed in August for an HTTP request processing flaw that could remotely reload the service.