**Cisco** has issued critical security updates to patch a zero-day vulnerability in its **Adaptive Security Appliance (ASA)** and **Threat Defense (FTD)** software. This high-severity denial-of-service (DoS) flaw, identified as **CVE-2026-76418**, is currently being exploited in the wild to remotely crash vulnerable firewall devices. ## Vulnerability Details The vulnerability impacts devices running ASA and FTD software where the 'webvpn' keyword is present in configurations and SSL VPN is enabled on at least one interface. Successful exploitation allows unauthenticated, remote attackers to trigger a DoS condition, leading to unexpected device reloads. **Cisco's Product Security Incident Response Team (PSIRT)** discovered evidence of active exploitation earlier this month. While the company has urged customers to patch immediately, specific indicators of compromise, targeted organizations, or attacker identities have not been disclosed. According to **Cisco**, "This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition." ## Mitigation Strategies Although no direct workarounds fully address the security issue, administrators unable to apply patches immediately can mitigate the risk by disabling secondary authentication on the `DefaultWEBVPNGroup` tunnel group or any other user-configured tunnel group list. ## Widespread Exposure Internet monitoring platform **Shadowserver** reports over 51,000 **Cisco ASA SSL VPN** devices currently exposed online. It's unclear how many of these have been secured or are honeypots.  *Internet-exposed Cisco ASA SSL VPN devices (Shadowserver)* ## A Pattern of Exploitation This is not an isolated incident for Cisco. Last year, the company patched two other ASA and FTD firewall flaws (**CVE-2025-20362** and **CVE-2025-20333**) that were actively exploited as zero-days, particularly targeting 5500-X Series devices with VPN web services enabled. The **US Cybersecurity and Infrastructure Security Agency (CISA)** responded with **Emergency Directive 25-03**, mandating federal agencies to secure their Cisco firewall devices within 24 hours. These attacks were linked to the **ArcaneDoor** campaign, which also leveraged two other zero-days (**CVE-2024-20353** and **CVE-2024-20359**) to breach government networks since November 2023. More recently, in August, Cisco addressed another DoS zero-day (**CVE-2026-20349**) impacting ASA and FTD firewall devices with SSL listen sockets enabled. Earlier this month, a zero-day (**CVE-2026-76519**) in its **Secure Email Gateway (SEG)** solution, allowing unauthenticated remote command execution with root privileges, was also patched. Since November 2021, CISA has flagged 101 Cisco security flaws as actively exploited, with seven of these also abused by ransomware groups. This consistent pattern highlights the critical importance of timely patching and robust security hygiene for all Cisco users.