New Cisco firewall zero-day exploited to crash SSL VPN devices

Cisco has issued patches for a newly disclosed zero-day, CVE-2026-76418, affecting Adaptive Security Appliance (ASA) and Threat Defense (FTD) software, after confirming it is being actively abused to crash firewalls remotely. The bug stems from flawed logic handling when secondary authentication is set up on a tunnel group, letting an unauthenticated attacker send a specially crafted connection request to the SSL VPN service and force the device to reboot, creating a denial-of-service condition. The flaw only affects devices with the 'webvpn' keyword present in configuration and SSL VPN active on at least one interface; Cisco says its PSIRT spotted exploitation attempts this October but has not shared who is behind them or which organizations were targeted. No official workaround exists, though admins unable to update right away can reduce risk by turning off secondary authentication on the DefaultWEBVPNGroup or custom tunnel groups—an urgent concern given that over 51,000 Cisco ASA SSL VPN appliances remain exposed to the internet according to Shadowserver.