<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/new-cisco-firewall-zero-day-being-actively-exploited-f2igznpoy" -->

---
title: New Cisco firewall zero-day being actively exploited
description: A high-severity flaw in Cisco's Remote Access SSL VPN service is being actively exploited to crash devices. Tracked as CVE-2026-76418 with a severity score of...
canonical: https://daily.dev/posts/new-cisco-firewall-zero-day-being-actively-exploited-f2igznpoy
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: New Cisco firewall zero-day being actively exploited | daily.dev
og:description: A high-severity flaw in Cisco's Remote Access SSL VPN service is being actively exploited to crash devices. Tracked as CVE-2026-76418 with a severity score of...
og:url: https://daily.dev/posts/new-cisco-firewall-zero-day-being-actively-exploited-f2igznpoy
og:image: https://api.daily.dev/og/posts/f2igZNPOY.png
og:image:alt: New Cisco firewall zero-day being actively exploited
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# New Cisco firewall zero-day being actively exploited

**[CSO Online](https://daily.dev/sources/csoonline)** · 3 min read · 0 upvotes · 0 comments

## Summary

A high-severity flaw in Cisco's Remote Access SSL VPN service is being actively exploited to crash devices. Tracked as CVE-2026-76418 with a severity score of 8.6, it affects Cisco Secure Firewall ASA and Secure Firewall Threat Defense when secondary authentication is configured on a tunnel group. A remote, unauthenticated attacker can send a crafted request to force a device reload. Cisco says there are no workarounds but has released patched versions, including ASA 9.24.10.1 and FTD 10.1.1. As a temporary step, Cisco suggests disabling secondary authentication on the default tunnel group, DefaultWEBVPNGroup.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.csoonline.com/article/4242420/new-cisco-firewall-zero-day-being-actively-exploited.html>

## Questions this post answers

### What is CVE-2026-76418 and how does it affect Cisco ASA and FTD devices?

CVE-2026-76418 is a high-severity flaw, rated 8.6, in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense. It stems from logic errors when secondary authentication is configured on a tunnel group, letting a remote, unauthenticated attacker send a crafted request during SSL VPN connection that forces a device reload, causing denial of service. It is under active exploitation.

_Teams patching VPN appliances track active exploitation details like these on daily.dev._

### Which Cisco ASA and FTD versions fix CVE-2026-76418?

Cisco patched the flaw in ASA versions 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, and 9.24.10.1, and in FTD versions 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1. There are no workarounds, so Cisco urges immediate updates to one of these releases.

_Admins planning a firewall patch cycle can keep these version numbers handy via daily.dev._

### Is there a temporary mitigation for the Cisco ASA/FTD SSL VPN zero-day if I can't patch immediately?

Yes, Cisco recommends disabling secondary authentication on any user-configured tunnel group list or on the default tunnel group, DefaultWEBVPNGroup, as a temporary mitigation. Cisco cautions this was only tested in its own lab environment and warns that any workaround may negatively affect network functionality, performance, or security posture depending on deployment conditions.

_Security teams weighing a stopgap fix against a full patch can follow updates like this on daily.dev._

## Similar posts on daily.dev

- [Cisco warns of ASA and FTD VPN flaw exploited to crash devices](https://daily.dev/posts/cisco-warns-of-asa-and-ftd-vpn-flaw-exploited-to-crash-devices-awbvdguob) · BleepingComputer · 1 upvotes · 0 comments
- [Critical Check Point VPN Zero-Day Exploited in the Wild \(CVE-2026-50751\)](https://daily.dev/posts/critical-check-point-vpn-zero-day-exploited-in-the-wild-cve-2026-50751--8lk5ari1g) · Rapid7 Cybersecurity Blog · 1 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#cisco](https://daily.dev/tags/cisco), [#vpn](https://daily.dev/tags/vpn), [#zero-day](https://daily.dev/tags/zero-day)

[View this post on daily.dev](https://daily.dev/posts/new-cisco-firewall-zero-day-being-actively-exploited-f2igznpoy)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"New Cisco firewall zero-day being actively exploited","url":"https://daily.dev/posts/new-cisco-firewall-zero-day-being-actively-exploited-f2igznpoy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-cisco-firewall-zero-day-being-actively-exploited-f2igznpoy"},"datePublished":"2026-10-29T19:35:46.732Z","dateModified":"2026-10-29T20:06:45.580Z","description":"A high-severity flaw in Cisco's Remote Access SSL VPN service is being actively exploited to crash devices. Tracked as CVE-2026-76418 with a severity score of...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/13b95ffe9cd534e2cb91a643fd46c093?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/13b95ffe9cd534e2cb91a643fd46c093?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-cisco-firewall-zero-day-being-actively-exploited-f2igznpoy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cisco,vpn,zero-day","timeRequired":"PT3M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"New Cisco firewall zero-day being actively exploited"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/new-cisco-firewall-zero-day-being-actively-exploited-f2igznpoy#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-76418 and how does it affect Cisco ASA and FTD devices?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-76418 is a high-severity flaw, rated 8.6, in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense. It stems from logic errors when secondary authentication is configured on a tunnel group, letting a remote, unauthenticated attacker send a crafted request during SSL VPN connection that forces a device reload, causing denial of service. It is under active exploitation. Teams patching VPN appliances track active exploitation details like these on daily.dev."}},{"@type":"Question","name":"Which Cisco ASA and FTD versions fix CVE-2026-76418?","acceptedAnswer":{"@type":"Answer","text":"Cisco patched the flaw in ASA versions 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, and 9.24.10.1, and in FTD versions 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1. There are no workarounds, so Cisco urges immediate updates to one of these releases. Admins planning a firewall patch cycle can keep these version numbers handy via daily.dev."}},{"@type":"Question","name":"Is there a temporary mitigation for the Cisco ASA/FTD SSL VPN zero-day if I can't patch immediately?","acceptedAnswer":{"@type":"Answer","text":"Yes, Cisco recommends disabling secondary authentication on any user-configured tunnel group list or on the default tunnel group, DefaultWEBVPNGroup, as a temporary mitigation. Cisco cautions this was only tested in its own lab environment and warns that any workaround may negatively affect network functionality, performance, or security posture depending on deployment conditions. Security teams weighing a stopgap fix against a full patch can follow updates like this on daily.dev."}}]}
```