Cisco Warns of Zero-Day Exploit Crashing SSL VPN Devices
Cisco has released security updates to address a high-severity denial-of-service zero-day vulnerability impacting Adaptive Security Appliance (ASA) and Threat Defense (FTD) software, which attackers are actively exploiting to crash firewall devices.
Radwan AbdulhadiEditor and technology writer
Active Exploitation of Zero-Day Flaw
Cisco has released security updates to address a high-severity denial-of-service zero-day vulnerability that attackers are actively utilizing to remotely crash vulnerable firewall devices. Tracked as CVE-2026-76418, this security flaw impacts hardware configurations running Adaptive Security Appliance (ASA) and Threat Defense (FTD) software.
The vulnerability specifically affects systems where configurations contain the 'webvpn' keyword and SSL VPN is enabled on at least one interface. When successfully exploited, unauthenticated remote attackers can trigger a denial-of-service (DoS) condition, forcing the targeted firewall device to reload unexpectedly.
Technical Details and Attack Mechanics
According to official details shared regarding the flaw, the issue stems from logic errors that occur when secondary authentication is configured on a tunnel group. An attacker can exploit this security vulnerability by transmitting a crafted request when connecting to the SSL remote access VPN.
Cisco said that a successful exploit allows the malicious actor to cause the affected device to reload, resulting in an operational DoS condition. The company's Product Security Incident Response Team (PSIRT) became aware of active exploitation earlier in the month, prompting strong recommendations for customers to upgrade to a fixed software release.
Mitigation and Workaround Options
While Cisco did not provide direct workarounds that entirely resolve the underlying security issue, administrators who are unable to immediately apply the patch can implement a temporary mitigation. This involves disabling secondary authentication either on the default DefaultWEBVPNGroup tunnel group or across any user-configured tunnel group lists.
Exposure remains a significant concern for network defenders. Internet monitoring platform Shadowserver currently tracks more than 51,000 Cisco ASA SSL VPN devices exposed online, though these figures do not distinguish between secured systems, unpatched targets, or active honeypots.
Broader Context of Cisco Security Incidents
This discovery follows a history of targeted campaigns against enterprise firewall infrastructure. Last year, Cisco patched two other flaws affecting ASA and FTD firewall devices while cautioning customers that attackers had exploited them in zero-day campaigns targeting 5500-X Series hardware.
Security agencies have repeatedly responded to similar threats. On past occasions, the US Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 25-03, ordering federal agencies to rapidly secure their vulnerable network equipment.
Furthermore, earlier security incidents were linked directly to the ArcaneDoor campaign, which previously exploited zero-day vulnerabilities to breach government networks. Additional incidents earlier this year also involved denial-of-service flaws and separate vulnerabilities in enterprise security solutions.
Sources
- BleepingComputerNew Cisco firewall zero-day exploited to crash SSL VPN devices
Continue chronologically
Related stories
Cisco Patches Actively Exploited SD-WAN Zero-Day Flaw
Cisco has released urgent patches for a critical zero-day authentication bypass vulnerability in Catalyst SD-WAN Manager actively exploited in the wild.
Cisco Warns of New SD-WAN Zero-Day Exploited in Attacks
Cisco has released security updates to address a critical zero-day vulnerability in Catalyst SD-WAN Manager actively exploited by attackers.
Cisco Patches Actively Exploited Secure Email Gateway Zero-Day
Cisco has released a security patch for a newly disclosed Secure Email Gateway zero-day vulnerability actively exploited in remote root command attacks.
Cisco Patches Exploited Firewall Zero-Day Flaw
Cisco has released security fixes for a remotely exploitable zero-day vulnerability in its Secure Firewall ASA and FTD software.
