Overview
- Cisco’s PSIRT confirmed in October 2026 that attackers have been exploiting a logic‑error zero‑day, tracked as CVE‑2026‑76418, and released fixed ASA and FTD software releases to stop the active attacks.
- The bug stems from logic errors in the Remote Access SSL VPN service when secondary authentication is set on a tunnel group, and a crafted unauthenticated request can cause the device to reload and produce a denial‑of‑service.
- Cisco published specific patched release numbers for multiple ASA and FTD versions and strongly urged customers to upgrade to those releases to remediate the vulnerability.
- As a temporary mitigation for systems that cannot patch immediately, administrators can disable secondary authentication on the DefaultWEBVPNGroup or on affected tunnel‑group lists though that reduces VPN security.
- Internet scans show more than 51,000 ASA SSL VPN endpoints exposed online, but Cisco has not released indicators of compromise or attribution, leaving the true scope and impact unclear and increasing the urgency for organizations to check and patch affected devices.