Cisco Secure Firewall 0-Day Exploited to Crash SSL VPNs
Cisco is patching CVE-2026-76418, a critical 0-day vulnerability in Secure Firewall ASA and FTD software that allows unauthenticated remote attackers to cause denial-of-service by crashing SSL VPN devices.
Cisco has issued an urgent security advisory for CVE-2026-76418, a critical zero-day vulnerability actively exploited in the wild that can cause Cisco Secure Firewall ASA and FTD devices to crash, leading to denial-of-service and disruption of remote access capabilities. The vulnerability, which carries a CVSS score of 8.6, was discovered by Eric Fernald while working on a Cisco Technical Assistance Center support case.
The flaw resides within the Remote Access SSL VPN service, specifically when secondary authentication is configured on a tunnel group. Attackers can send a specially crafted request during the VPN connection process, triggering an unexpected device reload. Notably, a successful VPN login is not a prerequisite for exploiting this vulnerability, as the affected processing path can be reached prior to authentication.
While Cisco's advisory confirms a denial-of-service condition resulting in device restarts and service interruptions, it does not report any confirmed data theft or instances of remote code execution. The company has not identified specific threat actors or victims associated with this exploitation. This vulnerability is distinct from previous Cisco firewall VPN crash attacks (CVE-2026-20349) and a separate zero-day code execution vulnerability in Cisco ASA (CVE-2025-20333), each possessing different root causes.
Exploitation requires specific configurations: vulnerable ASA or FTD software, an accessible SSL remote access VPN login service, and the presence of secondary authentication within the relevant tunnel group configuration. Administrators must verify if 'webvpn' is enabled on an interface and inspect tunnel groups for the 'secondary-authentication-server-group' setting. If 'tunnel-group-list enable' is configured, all tunnel groups, including the default 'DefaultWEBVPNGroup', must be checked, not just those displayed on the login page.
Cisco has released patches for affected versions of ASA and FTD software. For ASA, fixed releases include 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, and 9.24.10.1. For FTD, patched versions are 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1. Administrators are urged to apply the appropriate update for their specific software branch.
No direct workaround is provided by Cisco, but temporary mitigation guidance is available, focusing on tunnel group settings. Disabling the group list might offer some protection if the default group does not use secondary authentication. Otherwise, removing secondary authentication, while a potential mitigation, significantly lowers VPN security and requires careful consideration and review by administrators.
Cisco strongly recommends immediate patching to the fixed versions. To assist administrators, Cisco provides a Software Checker tool to help confirm which releases are vulnerable and to identify suitable patched software prior to planning upgrade procedures. The company emphasizes the importance of timely patching to prevent service disruptions and maintain secure remote access.