Cisco has warned that attackers are actively exploiting a newly disclosed vulnerability in its Secure Firewall products that can remotely crash affected devices running SSL VPN services.
The flaw, tracked as CVE-2026-76418, affects certain versions of Cisco Secure Firewall Adaptive Security Appliance, or ASA, software and Secure Firewall Threat Defense, or FTD, software.
Cisco said exploitation can cause affected firewall devices to reload unexpectedly, resulting in a denial-of-service condition that can interrupt remote VPN access and other services dependent on the appliance.
The company has released software updates and is urging customers to upgrade after its security team detected active exploitation during October.
Attack Does Not Require Authentication
The vulnerability exists in the Remote Access SSL VPN service and is caused by logic errors when secondary authentication is configured on a tunnel group.
An attacker does not need valid login credentials to exploit the flaw.
Instead, the attacker can send a specially crafted request while connecting to the SSL remote-access VPN service.
If successful, the request can force the firewall appliance to reload.
That makes the vulnerability primarily an availability threat rather than a data-theft or code-execution flaw.
Cisco’s CVSS assessment gives CVE-2026-76418 a severity score of 8.6 out of 10.
The scoring reflects the fact that the vulnerability can be exploited remotely, requires no privileges or user interaction and can have a significant impact on the availability of affected systems.
Only Certain VPN Configurations Are Vulnerable
Not every Cisco ASA or FTD deployment is exposed.
Cisco said a device is vulnerable when it runs an affected software release, its SSL remote-access VPN login service is reachable, and secondary authentication is configured for the relevant tunnel group.
Administrators can identify potentially exposed systems by checking whether the configuration includes the webvpn setting with SSL VPN enabled on an interface.
They must also review tunnel-group settings to determine whether secondary authentication is configured.
Cisco noted that a successful VPN login is not required for an attacker to reach the vulnerable processing path.
That means internet-facing systems meeting the affected configuration conditions can potentially be targeted before authentication takes place.
Cloud-delivered Firewall, Cloud-delivered Firewall Management Center, Secure Access and Secure Firewall Management Center software are among the Cisco products confirmed not to be affected.
Cisco Confirms Active Exploitation
Cisco’s Product Security Incident Response Team said it became aware of active exploitation of CVE-2026-76418 during October.
The company has not publicly identified the attackers, disclosed which organisations have been targeted or released detailed indicators of compromise linked to the activity.
Cisco has also not said how widespread the exploitation is.
The company nevertheless strongly recommends upgrading affected devices to fixed releases.
The vulnerability was originally identified by Cisco engineer Eric Fernald while the company was resolving a Technical Assistance Center support case.
Cisco published its security advisory on October 28.
The active exploitation makes patching more urgent because administrators are no longer dealing with a purely theoretical weakness.
Once exploitation has been observed in real-world attacks, unpatched internet-facing devices can become immediate targets for attackers scanning for vulnerable configurations.
Fixed Releases Available Across ASA And FTD
Cisco has released patches across multiple supported software branches.
For ASA software, fixed versions include releases such as 9.16.4.104, 9.18.4.96, 9.20.4.50 and later corrected versions depending on the branch.
For FTD software, fixed releases include 7.0.11, 7.2.13, 7.4.9, 7.6.7 and newer corrected versions.
Administrators should use Cisco’s official advisory and Software Checker to determine which update applies to their specific deployment.
Cisco says there is no complete workaround that removes the vulnerability without upgrading.
However, organisations unable to patch immediately can reduce exposure by disabling secondary authentication on affected tunnel groups.
That mitigation comes with an important trade-off.
Removing secondary authentication may weaken the security posture of remote-access VPN services, so Cisco recommends evaluating the operational and security consequences before applying the change.
The company describes mitigation only as a temporary step and continues to recommend installation of fixed software.
VPN Outages Can Disrupt Remote Operations
Although the flaw does not allow attackers to directly steal data or execute code, repeatedly crashing an enterprise firewall can still cause significant operational damage.
SSL VPN services are widely used to provide employees and administrators with remote access to internal networks.
If a firewall repeatedly reloads under attack, remote users may lose connectivity and business services relying on the appliance can be disrupted.
A denial-of-service attack against perimeter security infrastructure can also distract security teams while other activity is taking place elsewhere in the environment.
This is particularly relevant for organisations that depend heavily on remote connectivity or operate exposed VPN gateways across multiple locations.
Cisco firewall products have also been repeatedly targeted by sophisticated attackers in recent years.
That history makes actively exploited vulnerabilities in internet-facing VPN infrastructure especially important for security teams to address quickly.
Patching Is The Strongest Defence
For affected organisations, the priority is to identify whether their ASA or FTD devices match the vulnerable configuration and upgrade them to the fixed software versions.
Administrators should also review logs for unexplained device reloads or service interruptions that could indicate attempted exploitation.
Cisco has not published detailed attack indicators, so defenders may have limited ability to distinguish a malicious crash from another operational failure using signatures alone.
That increases the importance of preventive patching.
The vulnerability demonstrates how even a flaw that does not provide system access can become a serious threat when it affects devices positioned at the edge of an enterprise network.
For organisations relying on Cisco SSL VPN infrastructure, leaving CVE-2026-76418 unpatched now means remaining exposed to a weakness that attackers are already using in the wild.
