Cisco ASA SSL VPN Zero-Day CVE-2026-76418 Reloads Firewalls

Attackers are exploiting a Cisco ASA SSL VPN zero-day, CVE-2026-76418, to crash ASA and FTD firewalls without logging in. Cisco has released fixes. Any Cyprus firm that terminates remote access on one of these devices should check its tunnel-group configuration today.

What is CVE-2026-76418, the Cisco ASA SSL VPN zero-day?

CVE-2026-76418 is a high-severity denial-of-service flaw in Cisco Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. An unauthenticated, remote attacker sends a crafted request while connecting to the SSL remote access VPN, and the device reloads. Cisco’s Product Security Incident Response Team (PSIRT) became aware of exploitation in the wild in October 2026 but has published no indicators of compromise, victims or attribution. Take the CVSS vector and fixed-release table for your software train from the advisory.

A device is exposed only if it meets three conditions:

• the running configuration contains the webvpn keyword;
• SSL VPN is enabled on at least one interface;
• secondary authentication is configured on a tunnel group, including DefaultWEBVPNGroup.

Cisco attributes the bug to “logic errors when secondary authentication is configured on a tunnel group.” Devices without that combination fall outside Cisco’s stated conditions, so rank your fleet by it. Shadowserver tracks more than 51,000 Cisco ASA SSL VPN devices online, an exposure figure that does not separate patched units, honeypots or devices without secondary authentication. External network penetration testing maps every VPN listener an attacker can reach.

What should Cyprus teams do before and after the patch?

Upgrade to a fixed release. Cisco says no workaround fully addresses the flaw, and fixes are specific to each software train.

Confirm exposure on each VPN headend first. On ASA, show running-config webvpn lists the webvpn settings, including interfaces with SSL VPN enabled, and show running-config all tunnel-group reveals secondary-authentication settings the abbreviated output hides. On FTD, open each connection profile in the FMC remote access VPN policy, including DefaultWEBVPNGroup, and review its AAA settings. Make changes in FMC and deploy them from there.

1. If you cannot patch today, apply Cisco’s interim mitigation: disable secondary authentication on DefaultWEBVPNGroup and every user-configured tunnel group that uses it.
2. Treat that as a risk decision: log the exception, get risk-owner sign-off, watch VPN logins and restore the setting after you upgrade.
3. Preserve reload evidence. Forward syslog to a remote collector. On ASA, show version reports uptime and the last reload reason, and show crashinfo displays any crash file. An unexplained reload since October deserves investigation but does not prove exploitation.

Verify the fix through version and configuration checks, never by sending crafted requests to production. Across many tunnel groups and sites, a firewall and configuration review finds them faster.

What does a firewall reload mean for NIS2, DORA and CySEC firms?

A reload interrupts NAT, routing, inspection and site-to-site tunnels, not just remote-access sessions. For an EMI that can mean lost payment links; for an iGaming operator, a live-platform outage; for a ship manager, cut links to vessels. Vendors and outsourced SOC analysts often connect through the same VPN. High availability shortens one outage but not the next: an unauthenticated attacker can trigger the reload again after failover.

Exploitation alone does not make an incident reportable under NIS2 or DORA; that depends on the classification criteria and actual impact. Document the assessment anyway, with upgrade records, secondary-authentication configuration diffs and reload timestamps. CySEC and DORA reviewers ask for exactly that evidence.

How does this fit Cisco's run of firewall zero-days?

In August this year Cisco fixed CVE-2026-20349, another exploited ASA and FTD denial-of-service zero-day that hit devices with SSL listen sockets enabled. This month it also warned about CVE-2026-76519, an exploited Secure Email Gateway flaw allowing unauthenticated command execution as root.

Last September, attackers exploited CVE-2025-20362 and CVE-2025-20333 against 5500-X Series devices, and CISA’s Emergency Directive 25-03 gave federal agencies 24 hours to secure their Cisco firewalls. Cisco tied those attacks to ArcaneDoor, which had used CVE-2024-20353 and CVE-2024-20359 since November 2023. No public evidence links ArcaneDoor to CVE-2026-76418. CISA has flagged 101 exploited Cisco flaws since November 2021, seven also used by ransomware gangs.

FAQ

Does CVE-2026-76418 give an attacker a shell on the firewall?

Cisco's advisory describes only a denial-of-service impact: the device reloads. It does not describe code execution or data access.

Does CVE-2026-76418 affect Cisco FTD as well as ASA?

Yes, when FTD runs the vulnerable SSL VPN and secondary-authentication configuration. Check the connection profiles in the FMC remote access VPN policy.

Is there a workaround for the Cisco SSL VPN zero-day?

Cisco says no workaround fully addresses it. Disabling secondary authentication reduces exposure until you upgrade.

If your remote access runs through an ASA or FTD, our NIS2 compliance penetration testing checks the live edge configuration against the evidence your regulator expects.