Cisco Fixes Second Exploited Firewall VPN Zero-Day Since August

Cisco has released fixes for a vulnerability in its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. The flaw lets unauthenticated attackers remotely force affected firewalls to restart, disrupting their availability.

Tracked as CVE-2026-76418, the vulnerability has a CVSS severity score of 8.6 and affects the Remote Access SSL VPN service. Attackers can send a malicious request while connecting to the SSL VPN and trigger an unexpected restart without logging in successfully.

“A successful VPN login is not required to reach the affected processing path,” Cisco said in a security advisory.

An attack requires an unpatched firewall with its SSL VPN login service reachable from the internet. The device must also use secondary authentication in an affected tunnel group. Cisco attributed the flaw to logic errors involving tunnel groups configured with secondary authentication.

Cisco’s product security team learned in October that the vulnerability was being exploited in the wild. The company has not disclosed details about the attacks or identified the threat actors involved. The issue emerged during a Cisco Technical Assistance Center support case, and Cisco credited Eric Fernald with discovering it.

No workaround is available. Depending on the default tunnel group’s configuration, administrators can reduce exposure by disabling the tunnel group list or removing secondary authentication. Cisco warned that removing secondary authentication makes remote-access VPN connections less secure and recommended installing the software update.

Cisco’s Secure Access cloud-delivered firewall service and Secure Firewall Management Center are not affected.

The disclosure follows Cisco’s August release of fixes for CVE-2026-20349, another exploited ASA and FTD vulnerability in the Remote Access SSL VPN service. That flaw involved HTTP request processing and allowed unauthenticated attackers to trigger a firewall reload remotely. Cisco did not disclose details about those attacks and has not said whether the same threat actor exploited both vulnerabilities.