Cisco Patches Exploited Firewall Zero-Day Flaw
Cisco has issued software updates to address an actively exploited vulnerability affecting the Remote Access SSL VPN service in its firewall software.
Radwan AbdulhadiEditor and technology writer
Overview of the Vulnerability
Cisco recently released fixes for an actively exploited vulnerability affecting its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Tracked as CVE-2026-76418 with a CVSS score of 8.6, the security flaw resides directly within the Remote Access SSL VPN service of the targeted platforms.
According to the company, remote attackers can exploit the bug without authenticating to force the affected hardware device to restart unexpectedly. This unexpected restart disrupts overall system availability and impacts operations relying on continuous network connectivity.
Attack Mechanism and Requirements
Cisco attributes the root cause of the issue to logic errors that impact tunnel groups configured specifically with secondary authentication. The exploitation process involves sending a malicious request while connecting to the SSL VPN service.
The company clarified that a successful VPN login is not required to reach the affected processing path. For a successful attack to occur, the firewall must be running an unpatched software release, have its SSL VPN login service reachable, and utilize secondary authentication within an affected tunnel group.
Additionally, Cisco noted that its cloud-delivered firewall and management offerings, Secure Access, and the Secure Firewall Management Center are not vulnerable to this particular issue.
Discovery and Threat Intelligence
Cisco's product security team learned in October that the security flaw was actively being exploited in the wild. The vulnerability itself came to light during a Cisco TAC support case, and the organization officially credited Eric Fernald with discovering the issue.
To date, no specific information has been publicly shared regarding the exact nature of the attacks or the specific threat actors behind them. Comprehensive details surrounding the campaign remain scarce.
Mitigation and Security Guidance
There are no direct workarounds available to mitigate the vulnerability completely without applying the official software updates. However, depending on default tunnel group settings, customers can temporarily reduce their exposure by turning off the tunnel group list or removing secondary authentication.
Cisco has cautioned administrators that dropping secondary authentication makes remote access VPN environments less secure. Consequently, the company strongly recommends upgrading to a patched software release rather than relying on configuration changes.
Broader Context of Firewall Zero-Days
This incident marks the second ASA and FTD zero-day vulnerability exploited for denial-of-service attacks in recent months. Back in August, Cisco released patches for CVE-2026-20349, an HTTP request processing flaw that similarly allowed unauthenticated attackers to remotely trigger a system reload via the Remote Access SSL VPN service.
Similar to the recent event, Cisco did not disclose granular details regarding the earlier attacks. Security researchers and analysts point out that it remains unclear whether both flaws were leveraged by the same threat actor or independent groups.
Sources
- SecurityWeekAttackers Exploit Second Cisco Firewall VPN Zero-Day Since August
Continue chronologically
Related stories
Cisco Warns of Zero-Day Exploit Crashing SSL VPN Devices
Cisco has released security updates to patch a denial-of-service zero-day vulnerability in its Adaptive Security Appliance and Threat Defense software.
Cisco Patches Actively Exploited Secure Email Gateway Zero-Day
Cisco has released a security patch for a newly disclosed Secure Email Gateway zero-day vulnerability actively exploited in remote root command attacks.
Cisco Patches Actively Exploited SD-WAN Zero-Day Flaw
Cisco has released urgent patches for a critical zero-day authentication bypass vulnerability in Catalyst SD-WAN Manager actively exploited in the wild.
Cisco Warns of New SD-WAN Zero-Day Exploited in Attacks
Cisco has released security updates to address a critical zero-day vulnerability in Catalyst SD-WAN Manager actively exploited by attackers.
