Cisco patches actively exploited ASA/FTD VPN zero-day that crashes firewalls

· Cybersecurity · United States

Cisco released security updates for a high-severity flaw in Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software that it said has been exploited in the wild. Tracked as CVE-2026-76418 and rated 8.6 on the CVSS scale, the flaw lets unauthenticated attackers remotely force ASA and FTD firewalls to reload through the Remote Access SSL VPN service. It is the second Cisco firewall VPN zero-day exploited since August. Separately, Cisco also moved to patch an exploitable flaw in its Catalyst SD-WAN Controllers as researchers tied key-stealing malware to that intrusion. Administrators running internet-facing VPN services on these appliances face urgent patching windows because the bug can be triggered without credentials.

Why it matters：Edge firewalls are a primary target for state-linked and criminal intrusions; repeated zero-days in one vendor's VPN stack force enterprises to reassess how much internet exposure their perimeter devices carry.

Key points

  • CVE-2026-76418 is rated 8.6 on the CVSS scale and requires no authentication to trigger
  • The attack can force a firewall to reload remotely through the SSL VPN service
  • It is the second exploited Cisco firewall VPN zero-day since August

Sources (original reporting)

More stories from this day