Cisco Firewall Zero-Day Crashes SSL VPNs: Check ASA and FTD Now

Cisco has fixed a high-severity flaw in its Secure Firewall ASA and Firewall Threat Defense (FTD) software that attackers have already been using to knock remote-access VPNs offline. If your staff connect to the office through a Cisco SSL VPN, check your firewall version today.

What happened

On 28 October 2026 Cisco published a security advisory for CVE-2026-76418, a denial-of-service bug in the Remote Access SSL VPN service of ASA and FTD software. Cisco’s Product Security Incident Response Team said it became aware of attempts to exploit the flaw in the wild during October. The issue was discovered while Cisco engineers were resolving a customer support case.

The flaw is rated 8.6 on the CVSS scale. An attacker who is not logged in can send a specially crafted request while a VPN connection is being set up and force the firewall to reload. A successful VPN login is not required.

What the attacker gets, and what they don’t

Cisco describes the impact as denial of service: the device restarts, dropping every VPN session and, depending on your setup, interrupting other traffic through that firewall. The advisory does not report data theft or remote code execution. Even so, a firewall that can be restarted at will by anyone on the internet is a serious problem for any business that depends on remote access.

Who is affected

Your device is exposed only if all three of the following are true:

1. It runs a vulnerable ASA or FTD software release.
2. The SSL remote-access VPN login service is reachable, typically from the internet.
3. Secondary authentication is configured on a tunnel group. This includes the built-in DefaultWEBVPNGroup, which is easy to overlook.

Secondary authentication is a common setup in which users must pass a second check, such as a separate authentication server, after their first login. Many banks, fintechs, telecoms and larger SMEs in Nigeria use Cisco firewalls for staff VPN access, so IT teams should check rather than assume they are safe.

Cisco says its Secure Firewall Management Center software, Cloud-delivered Firewall, cloud-delivered FMC and Secure Access are not affected by this advisory.

Fixed versions

Cisco lists these as the first releases containing the fix. Anything older in the same release train is vulnerable:

• ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1, depending on your train.
• FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1.

Watch the build numbers closely. Researchers point out that fixes for an earlier Cisco VPN crash bug from August, CVE-2026-20349, use very similar version numbers. For example, ASA 9.20.4.49 includes the August fix but is still vulnerable to this new flaw. “We patched in August” is not the same as “we’re patched now”.

Context: firewalls are a favourite target

Internet-facing VPN and firewall devices have been a recurring target for attackers over the past few years, because they sit at the edge of the network and are often patched less often than desktops. This advisory is separate from CVE-2026-20349 and from CVE-2025-20333, an earlier ASA zero-day that allowed code execution. A crash bug may look less serious, but repeated reloads can disrupt operations, and outages are sometimes used to distract defenders or force administrators into risky emergency changes.

Why there may be no clues in your logs

Because the trigger happens before authentication, you may not see failed login attempts. The clearest sign is the reload itself. Unexplained firewall restarts in October are worth investigating.

What you should do

Check your exposure

1. On each ASA, run show version to see the software release.
2. Run show running-config webvpn. A webvpn section alone does not mean SSL VPN is on; look for an enable statement naming an interface.
3. Run show running-config tunnel-group and check every group, including DefaultWEBVPNGroup, for secondary-authentication-server-group.
4. For FTD, check the management centre under Devices, then VPN, then Remote Access, or Firepower Device Manager.

Fix it

• Upgrade to a fixed release. Cisco says there is no workaround that fully addresses the flaw. Note that the first fixed release is a minimum; pick a release suitable for production from Cisco’s guidance.
• If you must wait, Cisco documents temporary mitigations. If DefaultWEBVPNGroup does not use secondary authentication, running no tunnel-group-list enable removes the group drop-down menu without weakening security, though users may need help selecting the right group. If the default group does use secondary authentication, removing it reduces exposure but also lowers VPN security, so test carefully.

Look for signs of attack

• Run show crashinfo files and look for recent LINA crash files, whose timestamps show when the device went down.
• Do not reboot or rename files on a device you are investigating. Preserve logs from upstream equipment such as load balancers or intrusion prevention systems.

Firewalls protect everything behind them. Keep their software on a regular patch schedule, and subscribe to Cisco’s security advisories so the next warning reaches you on day one.

Sources

• Cyber Security News: Cisco Secure Firewall 0-Day Exploited to Crash SSL VPN Devices
• The Cyber Sec Guru: CVE-2026-76418 Cisco ASA and FTD SSL VPN zero-day explained
• BleepingComputer: New Cisco firewall zero-day exploited to crash SSL VPN devices