Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August

Cisco has shipped a fix for a zero-day vulnerability, CVE-2026-76418, that was being actively exploited against Secure Firewall ASA and FTD devices. Rated 8.6 on CVSS, the flaw lies in the Remote Access SSL VPN component and stems from logic errors in tunnel groups that use secondary authentication, allowing an unauthenticated remote attacker to send a crafted request and force an unexpected reboot, without ever completing a VPN login. Cisco says it learned of the in-the-wild exploitation in October via a TAC case, credits researcher Eric Fernald for the finding, and notes that cloud-delivered firewall, Secure Access, and Secure Firewall Management Center are not affected. There is no workaround beyond disabling the tunnel group list or removing secondary authentication (which weakens VPN security), so Cisco urges customers to install the update instead; this marks the second ASA/FTD VPN zero-day abused for denial-of-service attacks since CVE-2026-20349 was patched in August, though it's unknown if the same actor is behind both.