Cisco fixes exploited Secure Firewall VPN zero-day

Cisco released patches on October 28, 2026, for CVE-2026-76418, a high-severity flaw in its ASA and FTD firewall software that attackers exploited in the wild. The flaw carries a CVSS score of 8.6 and affects the Remote Access SSL VPN service, letting unauthenticated remote attackers force an unexpected device restart by sending a specially crafted request during VPN connection.

Cisco says the flaw stems from logic errors in tunnel groups that use secondary authentication. The company's advisory notes, "A successful VPN login is not required to reach the affected processing path." An attack requires unpatched software, a reachable SSL VPN login service, and a tunnel group with secondary authentication. Cisco's cloud-delivered firewall, Secure Access, Secure Firewall Management Center, and cloud-delivered FMC are not affected.

Cisco's product security team learned in October that the flaw was being exploited. The company has not disclosed details of the attacks or the actors behind them. Eric Fernald discovered the vulnerability during a Cisco Technical Assistance Center support case.

Cisco's advisory lists fixed ASA versions 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, plus 9.24.1.27 and 9.24.10.1. For FTD, fixed releases are 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1. There are no workarounds, but Cisco offers temporary mitigations based on tunnel group settings. Administrators should verify whether webvpn is enabled on an interface and check tunnel groups for the secondary-authentication-server-group setting. If the tunnel-group-list feature is on, all tunnel groups need review, including DefaultWEBVPNGroup, not only the ones shown on the login page. If the default tunnel group lacks secondary authentication, turning off the list can reduce exposure; otherwise, removing secondary authentication weakens VPN security, so Cisco recommends upgrading instead. Cisco also advises using its Software Checker to confirm exposure and pick the correct fixed release.

This is the second exploited zero-day in ASA and FTD VPN code in recent months. In August, Cisco fixed CVE-2026-20349, a flaw in how HTTP requests were processed that also let unauthenticated attackers remotely reload devices through the Remote Access SSL VPN service. Cisco has not said whether the same actor exploited both vulnerabilities.