> ## Content Index
> Fetch the complete content index at: https://blog.harshkohli.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Cisco Firewall Zero-Day Crashes VPNs: Patch Now
- URL: https://blog.harshkohli.com/cisco-asa-ftd-vpn-zero-day-exploited/
- Published: 2026-10-29T12:59:06.000Z
- Updated: 2026-11-11T10:06:15.000Z
- Description: Attackers are exploiting CVE-2026-76418 to reboot Cisco ASA and FTD firewalls with SSL VPN. Who is affected, the fixed releases and what to do now.
- Author: Harsh Kohli
- Tags: Tech News, Software

If your office VPN runs through a Cisco firewall, this one needs attention today. Cisco has patched a denial-of-service bug in its ASA and Firepower Threat Defense (FTD) software that attackers are already exploiting to knock firewalls offline. It's tracked as CVE-2026-76418, rated 8.6 out of 10, and the attacker doesn't need to log in.

## What happened

Cisco published an [advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75?ref=blog.harshkohli.com) this week for a flaw in the Remote Access SSL VPN service. The company says it comes from logic errors when secondary authentication is set up on a tunnel group. A crafted request sent while connecting to the VPN makes the device reload, and while it restarts, everything behind it loses its connection.

Cisco's security team says it became aware of active exploitation in October 2026\. It hasn't said who's behind the attacks or how widespread they are, and it hasn't shared indicators of compromise. The Hacker News [flagged the patch on X](https://x.com/TheHackersNews/status/2115757006145593440?ref=blog.harshkohli.com), and [BleepingComputer](https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/?ref=blog.harshkohli.com) points to Shadowserver data showing more than 51,000 Cisco ASA SSL VPN devices exposed online. Not all of them will have the vulnerable setup.

Your device is affected only if all three of these are true:

- It runs a vulnerable ASA or FTD release.
- SSL remote access VPN is enabled on at least one interface (the config has the `webvpn` keyword).
- Secondary authentication is configured on a tunnel group, including the default `DefaultWEBVPNGroup`.

Cisco says a successful VPN login isn't required to reach the buggy code, and that cloud-delivered firewall and Secure FMC software are not affected.

## Why it matters

A crash bug sounds less scary than remote code execution, and it is. But a firewall that can be rebooted on demand is a problem for any company whose remote staff rely on that VPN. Attackers can also use outages like this as cover for other activity. And this keeps happening: Cisco fixed a similar exploited ASA and FTD crash flaw in August, and CISA has now listed 101 Cisco flaws as exploited since late 2021.

It's the second firewall vendor in the same week, too. I covered the [PHP2Shell attacks on Palo Alto firewalls](https://blog.harshkohli.com/palo-alto-pan-os-php2shell-exploited/) earlier today.

## What to do

- **Upgrade.** Use the fixed-release table in Cisco's advisory, or its Software Checker, to find the right build for your train. For example, older ASA 9.16 trains are fixed in 9.16.4.104 and FTD 7.0 in 7.0.11.
- **Can't patch tonight?** Cisco says there's no real workaround. Its only mitigation is to stop using secondary authentication on the affected tunnel groups, and the advisory lists the exact commands (such as `no secondary-authentication-server-group`). That weakens your login security, so treat it as a stopgap and test it first.
- **Watch for unexpected reloads** in your firewall logs, and treat any recent ones as a sign you may have been targeted.

SonicWall firewalls have a similar exploited VPN flaw right now: see [SonicWall's SSL-VPN MFA bypass, CVE-2026-19868](https://blog.harshkohli.com/sonicwall-ssl-vpn-mfa-bypass-cve-19868/).