Cisco ASA/FTD SSL VPN zero-day CVE-2026-76418 exploited in the wild for unauthenticated remote DoS; patches released

Linha do tempo

1. cert.cyber.gouv.fr ↗ · pub. 28/10/2026 21:00 · coletado 30/10 14:01

   CERT-FR flags actively exploited Cisco Secure Firewall ASA/FTD remote DoS flaw CVE-2026-76418

   ler a análise desta fonte ocultar

   CERT-FR published advisory CERTFR-2026-AVI-1412 on 29 October 2026 about a vulnerability in Cisco Secure Firewall ASA Software and Secure FTD Software, tracked as CVE-2026-76418. A remote attacker can exploit it to cause a denial of service. Cisco states that the vulnerability is actively exploited. The advisory relays Cisco security bulletin cisco-sa-asaftd-tunnel-dos-s6mgkb75 of 28 October 2026. It gives no details on the attack vector, authentication requirements, threat actors or scale of exploitation.

   Technical Details

   • Impact: remote denial of service.
   • Affected: Secure Firewall ASA Software 9.16 and earlier (fixed in 9.16.4.104), 9.18.x (before 9.18.4.96), 9.20.x (before 9.20.4.50), 9.22.x (before 9.22.3.200), 9.23.x (before 9.23.1.48), and 9.24.x (the fixed version is garbled in the advisory).
   • Affected: Secure FTD Software 7.0 (before 7.0.11), 7.2.x (before 7.2.13), 7.4.x (before 7.4.9), 7.6.x (before 7.6.7), 7.7.x (before 7.7.14), 10.0.x (before 10.0.3) and 10.1.x (before 10.1.1).
   • The advisory does not describe the underlying flaw. The bulletin name suggests a tunnel-related component, but the advisory does not confirm this.

   Remediation

   • Apply the fixes listed in Cisco bulletin cisco-sa-asaftd-tunnel-dos-s6mgkb75. Prioritise internet-facing ASA and FTD devices because exploitation is confirmed.
2. bleepingcomputer.com ↗ · pub. 29/10/2026 08:10 · coletado 29/10 09:00

   Cisco patches ASA/FTD zero-day CVE-2026-76418 exploited to crash SSL VPN firewalls

   BleepingComputer adds that Shadowserver tracks more than 51,000 Cisco ASA SSL VPN devices exposed online (patch status unknown), that Cisco shared no IOCs, targets or attribution, and that the mitigation is to disable secondary authentication on DefaultWEBVPNGroup or user-configured tunnel groups. It also places the flaw in context with the ArcaneDoor zero-days, the August CVE-2026-20349 and the October SEG zero-day CVE-2026-76519.

   ler a análise desta fonte ocultar

   BleepingComputer adds that Shadowserver tracks more than 51,000 Cisco ASA SSL VPN devices exposed online (patch status unknown), that Cisco shared no IOCs, targets or attribution, and that the mitigation is to disable secondary authentication on DefaultWEBVPNGroup or user-configured tunnel groups. It also places the flaw in context with the ArcaneDoor zero-days, the August CVE-2026-20349 and the October SEG zero-day CVE-2026-76519.

   Cisco released updates for CVE-2026-76418, a high-severity denial-of-service zero-day in Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software that attackers are exploiting in the wild. An unauthenticated remote attacker can send a crafted request to the SSL remote access VPN and force the device to reload. Cisco PSIRT became aware of the exploitation in October 2026, but Cisco has not shared IOCs, targeted organizations or attribution. Shadowserver tracks more than 51,000 Cisco ASA SSL VPN devices exposed online, though it does not say how many are already patched or are honeypots.

   Technical Details

   • Affected devices run ASA or FTD with the webvpn keyword in the configuration and SSL VPN enabled on at least one interface.
   • The root cause is a logic error when secondary authentication is configured on a tunnel group.
   • Exploitation requires no authentication and results in an unexpected reload (DoS).
   • This is the second ASA/FTD DoS zero-day this year: CVE-2026-20349 was fixed in August. Earlier this month Cisco also patched the actively exploited Secure Email Gateway zero-day CVE-2026-76519 (root RCE).
   • Background: the 2025 CVE-2025-20362 and CVE-2025-20333 zero-days were tied to the ArcaneDoor campaign, and CISA has flagged 101 Cisco flaws as exploited since November 2021.

   Remediation

   • Upgrade to a fixed software release, as Cisco strongly recommends.
   • Cisco offers no workaround, but admins who cannot patch immediately can disable secondary authentication on the default DefaultWEBVPNGroup tunnel group or on any user-configured tunnel group list.
3. securityweek.com ↗ · pub. 29/10/2026 06:47 · coletado 29/10 08:00

   Cisco patches second actively exploited ASA/FTD SSL VPN zero-day, CVE-2026-76418, enabling unauthenticated DoS

   SecurityWeek links CVE-2026-76418 to the August 2026 ASA/FTD zero-day CVE-2026-20349, an HTTP request processing DoS flaw in the same Remote Access SSL VPN service, making this the second exploited DoS zero-day in the product line in recent months. Cisco has not said whether the same actor is behind both, and it also confirms that no workarounds exist and that attack details remain undisclosed.

   ler a análise desta fonte ocultar

   SecurityWeek links CVE-2026-76418 to the August 2026 ASA/FTD zero-day CVE-2026-20349, an HTTP request processing DoS flaw in the same Remote Access SSL VPN service, making this the second exploited DoS zero-day in the product line in recent months. Cisco has not said whether the same actor is behind both, and it also confirms that no workarounds exist and that attack details remain undisclosed.

   Cisco released fixes on Wednesday for CVE-2026-76418 (CVSS 8.6), an exploited vulnerability in the Remote Access SSL VPN service of Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. An unauthenticated remote attacker can force the device to restart unexpectedly, disrupting availability. Cisco's product security team learned of in-the-wild exploitation in October, but no details on the attacks or the actors behind them have been shared. This is the second ASA/FTD zero-day exploited for DoS in recent months, after CVE-2026-20349 was patched in August. It is unclear whether the same threat actor is behind both.

   Technical Details

   • The root cause is a logic error affecting tunnel groups configured with secondary authentication. Exploitation involves a malicious request sent while connecting to the SSL VPN. Cisco notes that "a successful VPN login is not required to reach the affected processing path."
   • Exploitation requires an unpatched release, a reachable SSL VPN login service, and secondary authentication in an affected tunnel group.
   • Cisco's cloud-delivered firewall and management offerings, Secure Access and Secure Firewall Management Center are not vulnerable.
   • The flaw was found during a Cisco TAC support case and credited to Eric Fernald.
   • The August flaw, CVE-2026-20349, is an HTTP request processing bug that also lets unauthenticated attackers remotely trigger a reload through the Remote Access SSL VPN service.

   Remediation

   • Upgrade to a fixed ASA/FTD release. Cisco says no workarounds are available.
   • Depending on the default tunnel group's settings, exposure can be reduced by turning off the tunnel group list or removing secondary authentication. Cisco warns that dropping secondary authentication makes remote access VPN less secure and recommends upgrading instead.
4. gbhackers.com ↗ · pub. 29/10/2026 05:22 · coletado 29/10 06:00

   Cisco patches actively exploited unauthenticated SSL VPN DoS flaw (CVE-2026-76418) in ASA and FTD

   The article reports that Cisco's PSIRT found active exploitation of CVE-2026-76418 earlier in October 2026, contradicting the earlier claim that the advisory does not mention exploitation. It adds the full list of fixed ASA and FTD releases, configuration checks to determine exposure, the researcher credit (Eric Fernald), and temporary mitigations, which differ from the earlier 'no workarounds exist' statement.

   ler a análise desta fonte ocultar

   The article reports that Cisco's PSIRT found active exploitation of CVE-2026-76418 earlier in October 2026, contradicting the earlier claim that the advisory does not mention exploitation. It adds the full list of fixed ASA and FTD releases, configuration checks to determine exposure, the researcher credit (Eric Fernald), and temporary mitigations, which differ from the earlier 'no workarounds exist' statement.

   Cisco has released fixes for CVE-2026-76418, a high-severity (CVSS 8.6) flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Threat Defense (FTD) software. An unauthenticated attacker can send a crafted request and force the firewall to reload, causing a denial of service. Cisco published its advisory on October 28, 2026, after its Product Security Incident Response Team found active exploitation earlier in the month. The advisory does not name the attackers, victims or campaign scale. The flaw was found by Eric Fernald while he was resolving a Cisco TAC support case.

   Technical Details

   • Root cause is a logic error when secondary authentication is configured on a VPN tunnel group. A crafted request reaches the vulnerable code path without a successful login.
   • Exposure requires vulnerable software, a reachable SSL VPN login service, and secondary authentication in the relevant tunnel-group configuration.
   • Check the configuration for webvpn with enable <interface_name>, then review secondary authentication settings. If tunnel-group-list enable is present, inspect every tunnel group, including DefaultWEBVPNGroup and groups not shown on the login page. If the list is disabled, the default group is still relevant.
   • The impact is availability only, not RCE or data theft. This is distinct from earlier Cisco SSL VPN DoS reports (a session-handling bug) and from flaws that require valid VPN credentials.
   • Cloud-delivered Firewall, Cloud-delivered FMC, Secure Access and Secure FMC Software are unaffected.

   Remediation

   • Upgrade to a fixed release. ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, 9.24.10.1. FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1.
   • Use the Cisco Software Checker to confirm exposure. FTD admins should review policies and device configuration through FMC or FDM.
   • Cisco lists no workaround but describes temporary mitigations. If the default group lacks secondary authentication, run no tunnel-group-list enable. If it uses secondary authentication, no secondary-authentication-server-group removes the exposure but weakens VPN security. These do not replace patching.
5. sec.cloudapps.cisco.com ↗ · pub. 28/10/2026 16:15 · coletado 28/10 18:00 primeiro registro só resumo do feed

   Cisco ASA and FTD Remote Access SSL VPN flaw (CVE-2026-76418) allows unauthenticated remote DoS

   ler a análise desta fonte ocultar

   Cisco has disclosed CVE-2026-76418, a vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. An unauthenticated, remote attacker can send a crafted request during an SSL VPN connection and force the device to reload unexpectedly, causing a denial of service. Cisco rates the Security Impact as High, has released software updates, and states that no workarounds exist. The advisory does not mention exploitation in the wild.

   Technical Details

   • The root cause is a logic error when secondary authentication is configured on a tunnel group.
   • The attack vector is a crafted request sent while connecting to the SSL remote access VPN, with no authentication required.
   • Successful exploitation causes an unexpected device reload, resulting in a DoS condition.

   Remediation

   • Apply the Cisco software updates referenced in advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75.
   • No workarounds are available, so patching is the only mitigation.

Repetiram sem novidade

• thehackernews.com — Cisco patches actively exploited ASA/FTD SSL VPN flaw CVE-2026-76418 that lets attackers crash firewalls