Reported by 2 outlets
The story so far
AI summary of the reporting below · Updated · How we work
Cisco has rolled out security patches for an actively exploited denial-of-service zero-day vulnerability affecting its Adaptive Security Appliance and Firepower Threat Defense software. The high-severity bug, cataloged as CVE-2026-76418, enables unauthenticated remote attackers to unexpectedly reload vulnerable firewall appliances by sending crafted connection requests to the SSL remote access VPN service. [1][2]
The issue stems from logic errors triggered when secondary authentication is active on a tunnel group, requiring affected devices to have the 'webvpn' keyword configured and SSL VPN enabled on at least one interface. Cisco's Product Security Incident Response Team uncovered in-the-wild exploitation earlier in October 2026. While the company has not published indicators of compromise or specific targeting details, it advises administrators unable to apply the updates immediately to disable secondary authentication on the default DefaultWEBVPNGroup or any user-defined tunnel groups. [1]
The exposure remains significant, with internet monitoring platform Shadowserver tracking more than 51,000 Cisco ASA SSL VPN devices online, though it is unclear how many are already secured. The incident follows an earlier denial-of-service zero-day patched in August, as network infrastructure hardware continues to be heavily targeted by threat actors. [1][2]
Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices.
via BleepingComputerAn exploited flaw in the Remote Access SSL VPN service lets unauthenticated attackers remotely force ASA and FTD firewalls to reload.
via SecurityWeek