Cisco patches actively exploited second ASA and FTD VPN zero-day since August

Cisco released fixes for CVE-2026-76418, a Remote Access SSL VPN zero-day, or previously unknown flaw, in Secure Firewall ASA and FTD software, after Cisco product security learned in October 2026 that attackers were exploiting it in the wild to force unauthenticated remote device restarts.

The flaw carries a CVSS score of 8.6 on the standard severity scale and is rated high severity. It arises from logic errors involving secondary authentication on a tunnel group, and exploitation involves sending a crafted request while connecting to the SSL remote access VPN. Cisco said in a Wednesday advisory, “This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group.” The company also noted, “A successful VPN login is not required to reach the affected processing path.”

Vulnerable devices are ASA or FTD systems with the SSL remote access VPN login service reachable and secondary authentication configured in the tunnel group scope. Affected configurations contain the webvpn keyword with SSL VPN enabled on at least one interface.

Shadowserver, a security tracking project, tracks more than 51,000 Cisco ASA SSL VPN devices exposed online. The project does not provide information on how many of those devices have been secured or are honeypots. Cisco has not shared details about the attacks, targeted organizations, or the threat actors behind the exploitation. It remains unclear whether the same threat actor exploited both CVE-2026-76418 and CVE-2026-20349.

CVE-2026-76418 is the second ASA and FTD zero-day exploited for denial-of-service attacks, which crash or disrupt systems, in recent months. In August 2026, Cisco patched CVE-2026-20349, an HTTP request processing flaw enabling unauthenticated attackers to remotely trigger a reload via Remote Access SSL VPN. Cisco said attackers were actively exploiting that flaw in the wild to crash ASA and FTD devices with SSL listen sockets enabled. “Depending on the impact of the attack, a reload of the device may be required to restore the RAVPN service,” Cisco said in its report.

Last year Cisco patched CVE-2025-20362 and CVE-2025-20333 after zero-day attacks, exploits against previously unknown flaws, targeted 5500-X Series devices with VPN web services enabled. Cisco linked those 2025 attacks to the ArcaneDoor campaign, which also exploited CVE-2024-20353 and CVE-2024-20359 to breach government networks since November 2023. Since November 2021, CISA has identified 101 Cisco security flaws that attackers exploited in the wild, and ransomware actors also used seven of those flaws. CISA issued Emergency Directive 25-03 ordering federal agencies to secure Cisco firewall devices within 24 hours.

On October 24, 2024, Cisco addressed CVE-2024-20481, a medium-severity brute-force denial-of-service bug in Remote Access VPN in ASA and FTD. Earlier in October 2026, Cisco warned about CVE-2026-76519 in Secure Email Gateway, allowing unauthenticated attackers to execute commands remotely with root privileges.

No workarounds are available for CVE-2026-76418. Cisco strongly recommends that customers upgrade to a fixed software release to remediate the vulnerability. Fixed ASA releases include 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1. Fixed FTD releases include 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1.

Customers can lower exposure by turning off the tunnel group list or removing secondary authentication depending on default tunnel group settings. Cisco cautioned that removing secondary authentication makes remote access VPN less secure and recommends upgrading instead. Temporary mitigation includes disabling secondary authentication on tunnel group lists or DefaultWEBVPNGroup, or turning off the tunnel group list if DefaultWEBVPNGroup does not use secondary authentication.

For FTD, administrators should review the deployed remote access VPN policy and device running configuration in Cisco Secure FMC or Cisco Secure FDM. When tunnel-group-list enable is configured, administrators should check all tunnel groups including DefaultWEBVPNGroup for secondary-authentication-server-group. When tunnel-group-list enable is absent, administrators should still check DefaultWEBVPNGroup because removing the group list does not remove exposure if that default group uses secondary authentication.

The vulnerability surfaced during a Cisco TAC, or technical assistance center, support case, and Cisco credited Eric Fernald with finding it. Cisco said in its advisory that its cloud-delivered firewall and management offerings, Secure Access, and Secure Firewall Management Center are not vulnerable.