Cisco patches ASA and FTD VPN zero-day that crashes firewalls

Cisco (Nasdaq: CSCO) has released fixes for CVE-2026-76418, a flaw in the Remote Access SSL VPN service of its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software that attackers are already exploiting. An attacker with no login can send a crafted request to the VPN that makes the firewall crash and reload, causing a denial of service, according to the advisory Cisco published on October 28 at 3:15 p.m. ET.

The flaw is the second exploited zero-day in Cisco's firewall VPN since August, SecurityWeek reported. The first, CVE-2026-20349, was in the same service, and its patch does not cover the new one: every release Cisco named as the fix for CVE-2026-20349 is on Cisco's own list of releases affected by CVE-2026-76418. A firewall running one of them needs another upgrade if it is exposed.

What an attacker can do

Cisco rates the flaw High, with a CVSS score of 8.6 out of 10. The score counts the effect on availability as high and on the confidentiality and integrity of data as none: the advisory describes a way to crash the device, not to read data or run code on it. Cisco said the cause is “logic errors when secondary authentication is configured on a tunnel group,” and that the attacker sends the request while connecting to the VPN.

A successful VPN login is not required to reach the affected processing path.Cisco's security advisory for CVE-2026-76418, October 28

Cisco's product security team “became aware of active exploitation” in October, the advisory said, so attackers were using the flaw before Cisco disclosed it. Cisco has not said who is behind the attacks, whom they target or how many devices were hit, and the advisory lists no indicators of compromise. Cisco credited Eric Fernald with finding the flaw while resolving a Cisco Technical Assistance Center support case.

Which firewalls are exposed

A device is vulnerable only when three things are true, Cisco said: it runs an affected ASA or FTD release, its SSL VPN login service is reachable, and secondary authentication is set on a tunnel group, the connection profile a VPN user signs in through. Secondary authentication makes users pass a second credential check against a second authentication server, a setting meant to make VPN logins harder to break into. The advisory's checks:

• SSL VPN is on if the running configuration contains webvpn with SSL VPN enabled on at least one interface.

• If tunnel-group-list enable is set, check every tunnel group, including the default DefaultWEBVPNGroup, for secondary-authentication-server-group, not only the profiles shown on the login page.

• If the group list is off, still check DefaultWEBVPNGroup. Turning the list off does not remove the exposure when the default group uses secondary authentication.

• On FTD, review the deployed remote access VPN policy and the device's running configuration in Secure Firewall Management Center or Device Manager.

Cisco's machine-readable advisory lists affected software on its ASA 5500-X, Firepower, ISA 3000 and Secure Firewall hardware and on its virtual firewalls. Cisco said Cloud-delivered Firewall, its cloud-delivered management center, Secure Access and Secure Firewall Management Center software are not affected.

What to upgrade to

“Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability,” the advisory said. In every release train, the first fixed release for the October flaw is a later build than the one that fixed August's:

First fixed releases for CVE-2026-20349 (the August advisory as updated September 16) and CVE-2026-76418. Source: Cisco.

Cisco's Software Checker shows every Cisco advisory that affects a given release.

If you cannot upgrade yet

No workaround addresses the flaw, Cisco said, but it offered a mitigation it considers temporary, and it advised customers to weigh the effect on their own networks first:

• If DefaultWEBVPNGroup does not use secondary authentication, turn off the tunnel group list with no tunnel-group-list enable. Users can then no longer pick a connection profile from a list and must know which one to use.

• If DefaultWEBVPNGroup does use it, remove secondary authentication with no secondary-authentication-server-group. Cisco warned that doing so lowers the security of remote access VPN.

Timeline

• August 11: Cisco discloses CVE-2026-20349, a separate flaw in the same service that also reloads firewalls, and says it is being exploited. CISA adds it the same day to its Known Exploited Vulnerabilities catalog, which sets fix deadlines for federal civilian agencies, with a due date of August 14.

• September 16: Cisco updates that advisory to point customers to new hardening releases, which include the fix.

• October: Cisco learns that CVE-2026-76418 is being exploited.

• October 28, 3:15 p.m. ET: Cisco publishes the CVE-2026-76418 advisory, with fixed software available.

• October 29, 10:44 a.m. ET: CVE-2026-76418 is not in CISA's catalog, which lists 101 exploited Cisco vulnerabilities.

What came before

The VPN on Cisco's firewalls has been attacked before. In September 2025, CISA's Emergency Directive 25-03 ordered federal agencies to act against “an ongoing exploitation campaign by an advanced threat actor targeting Cisco Adaptive Security Appliances,” which used two zero-days in the VPN web server, CVE-2025-20333 and CVE-2025-20362, to run code remotely and gain privileges. Cisco tied that campaign to the ArcaneDoor activity identified in early 2024. CISA updated the directive in April 2026, saying Cisco's patches did not necessarily remove an attacker already inside a device.

Cisco has not linked the August or October flaws to that campaign, or named an attacker for either.