Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

Cisco ASA and FTD zero-day CVE-2026-76418 exploited to crash SSL VPN firewalls

Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD)

Cisco patched CVE-2026-76418 (CVSS 8.6), a denial-of-service bug in the Remote Access SSL VPN service of Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Logic errors when secondary authentication is configured on a tunnel group let an unauthenticated, remote attacker send a crafted request while connecting to the SSL VPN and make the device reload; a successful VPN login is not needed. Cisco PSIRT became aware of active exploitation in October 2026 and strongly recommends upgrading. Devices are affected when webvpn is enabled on an interface and a tunnel group (including DefaultWEBVPNGroup) uses secondary-authentication-server-group. There is no workaround, but disabling secondary authentication mitigates it. Shadowserver tracks more than 51,000 internet-exposed ASA SSL VPN devices.

Why this severity: Cisco rates it High (CVSS 8.6) and confirms exploitation in the wild; unauthenticated remote reload of the firewall

Started
Oct 28, 2026
CVE
CVE-2026-76418

Follow this incident

Discuss on X ↗

Affected

  • Cisco ASA Software before 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 and 9.24.1.27 (per train) with SSL remote access VPN enabled and secondary authentication on a tunnel group
  • Cisco FTD Software before 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1 (per train) with the same configuration

Fixed in

  • ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27
  • FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1
  • Not affected: Cloud-delivered Firewall, cdFMC, Secure Access and Secure FMC Software

Timeline2

  1. BleepingComputer reports the zero-day; Shadowserver tracks more than 51,000 internet-exposed Cisco ASA SSL VPN devices.

  2. Cisco publishes advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418 with fixed ASA and FTD releases, saying PSIRT became aware of active exploitation in October 2026.

Advisories2

News & write-ups2
Posts1
The Hacker News
@TheHackersNews

🚨 Cisco patches actively exploited ASA and FTD firewall flaw. CVE-2026-76418 (CVSS 8.6) can let unauthenticated attackers remotely crash affected firewalls, causing denial of service. No successful VPN login required. Details + affected versions ↓ t.co/c0xxNRltVP

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo