--- title: New Cisco firewall zero-day exploited to crash SSL VPN... description: Cisco patched a denial-of-service zero-day in ASA and FTD software that attackers are actively exploiting to crash SSL VPN firewalls. Tracked as... canonical: https://daily.dev/posts/new-cisco-firewall-zero-day-exploited-to-crash-ssl-vpn-devices-vmasng1ni twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New Cisco firewall zero-day exploited to crash SSL VPN devices | daily.dev og:description: Cisco patched a denial-of-service zero-day in ASA and FTD software that attackers are actively exploiting to crash SSL VPN firewalls. Tracked as... og:url: https://daily.dev/posts/new-cisco-firewall-zero-day-exploited-to-crash-ssl-vpn-devices-vmasng1ni og:image: https://api.daily.dev/og/posts/VMAsng1nI.png og:image:alt: New Cisco firewall zero-day exploited to crash SSL VPN devices og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New Cisco firewall zero-day exploited to crash SSL VPN devices **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 3 upvotes · 0 comments ## Summary Cisco patched a denial-of-service zero-day in ASA and FTD software that attackers are actively exploiting to crash SSL VPN firewalls. Tracked as CVE-2026-76418, it affects devices with 'webvpn' configured and SSL VPN enabled, letting unauthenticated attackers force a reload via a crafted request when secondary authentication is set on a tunnel group. Cisco's PSIRT spotted exploitation in October 2026 and provides no workarounds that address the issue, though admins can mitigate it by disabling secondary authentication on the tunnel group. Shadowserver tracks over 51,000 exposed Cisco ASA SSL VPN devices online. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-76418 and how does it affect Cisco ASA and FTD devices? CVE-2026-76418 is a high-severity denial-of-service vulnerability in Cisco ASA and FTD software caused by logic errors when secondary authentication is configured on a tunnel group. It affects devices with 'webvpn' in their configuration and SSL VPN enabled on at least one interface. An unauthenticated attacker can send a crafted request during SSL VPN connection to force the device to reload. Cisco's PSIRT found active exploitation in October 2026. _Teams tracking Cisco ASA firewall exposure can follow new CVE disclosures like this one on daily.dev._ ### Is there a workaround for the Cisco ASA/FTD SSL VPN DoS vulnerability if I can't patch immediately? Yes, disable secondary authentication on the default DefaultWEBVPNGroup tunnel group or on any user-configured tunnel group list. Cisco provided no other workaround for CVE-2026-76418 and strongly recommends upgrading to a fixed software release instead, since the mitigation only reduces exposure rather than fully remediating the flaw. _Admins weighing stopgap fixes against full patches can keep tabs on Cisco VPN advisories via daily.dev._ ### How many Cisco ASA SSL VPN devices are exposed to the internet? More than 51,000 Cisco ASA SSL VPN devices are exposed online, according to Internet monitoring platform Shadowserver. That count doesn't distinguish between devices already patched, still vulnerable, or set up as honeypots, so the real at-risk number could be lower or higher. _Security teams gauging exposure scale can track Cisco VPN vulnerability reporting on daily.dev._ ## Similar posts on daily.dev - [Cisco warns of ASA and FTD VPN flaw exploited to crash devices](https://daily.dev/posts/cisco-warns-of-asa-and-ftd-vpn-flaw-exploited-to-crash-devices-awbvdguob) · BleepingComputer · 1 upvotes · 0 comments - [Critical Check Point VPN Zero-Day Exploited in the Wild \(CVE-2026-50751\)](https://daily.dev/posts/critical-check-point-vpn-zero-day-exploited-in-the-wild-cve-2026-50751--8lk5ari1g) · Rapid7 Cybersecurity Blog · 1 upvotes · 0 comments - [Beyond the Patch: Understanding the SonicWall SSL-VPN MFA Bypass Exposure](https://daily.dev/posts/beyond-the-patch-understanding-the-sonicwall-ssl-vpn-mfa-bypass-exposure-oyurx5iv5) · InfoSec Write-ups · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#vpn](https://daily.dev/tags/vpn), [#zero-day](https://daily.dev/tags/zero-day), [#firewall](https://daily.dev/tags/firewall) [View this post on daily.dev](https://daily.dev/posts/new-cisco-firewall-zero-day-exploited-to-crash-ssl-vpn-devices-vmasng1ni) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New Cisco firewall zero-day exploited to crash SSL VPN devices","url":"https://daily.dev/posts/new-cisco-firewall-zero-day-exploited-to-crash-ssl-vpn-devices-vmasng1ni","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-cisco-firewall-zero-day-exploited-to-crash-ssl-vpn-devices-vmasng1ni"},"datePublished":"2026-10-29T11:10:26.687Z","dateModified":"2026-10-29T20:06:45.577Z","description":"Cisco patched a denial-of-service zero-day in ASA and FTD software that attackers are actively exploiting to crash SSL VPN firewalls. Tracked as...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9be1c29e40e7fb27a39d7f4ab48ea8fe?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9be1c29e40e7fb27a39d7f4ab48ea8fe?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-cisco-firewall-zero-day-exploited-to-crash-ssl-vpn-devices-vmasng1ni","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,vpn,zero-day,firewall","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"New Cisco firewall zero-day exploited to crash SSL VPN devices"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/new-cisco-firewall-zero-day-exploited-to-crash-ssl-vpn-devices-vmasng1ni#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-76418 and how does it affect Cisco ASA and FTD devices?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-76418 is a high-severity denial-of-service vulnerability in Cisco ASA and FTD software caused by logic errors when secondary authentication is configured on a tunnel group. It affects devices with 'webvpn' in their configuration and SSL VPN enabled on at least one interface. An unauthenticated attacker can send a crafted request during SSL VPN connection to force the device to reload. Cisco's PSIRT found active exploitation in October 2026. Teams tracking Cisco ASA firewall exposure can follow new CVE disclosures like this one on daily.dev."}},{"@type":"Question","name":"Is there a workaround for the Cisco ASA/FTD SSL VPN DoS vulnerability if I can't patch immediately?","acceptedAnswer":{"@type":"Answer","text":"Yes, disable secondary authentication on the default DefaultWEBVPNGroup tunnel group or on any user-configured tunnel group list. Cisco provided no other workaround for CVE-2026-76418 and strongly recommends upgrading to a fixed software release instead, since the mitigation only reduces exposure rather than fully remediating the flaw. Admins weighing stopgap fixes against full patches can keep tabs on Cisco VPN advisories via daily.dev."}},{"@type":"Question","name":"How many Cisco ASA SSL VPN devices are exposed to the internet?","acceptedAnswer":{"@type":"Answer","text":"More than 51,000 Cisco ASA SSL VPN devices are exposed online, according to Internet monitoring platform Shadowserver. That count doesn't distinguish between devices already patched, still vulnerable, or set up as honeypots, so the real at-risk number could be lower or higher. Security teams gauging exposure scale can track Cisco VPN vulnerability reporting on daily.dev."}}]} ```