If you run a Cisco ASA or Firepower Threat Defense box with SSL VPN, put this at the top of your list.
The bug
CVE-2026-76418 is a high-severity denial-of-service flaw. It affects ASA and FTD devices whose config has the webvpn keyword and SSL VPN enabled on at least one interface. It’s caused by logic errors when secondary authentication is set on a tunnel group. An unauthenticated remote attacker can send a crafted request and make the device reload. Cisco PSIRT saw it exploited in the wild this month but hasn’t shared indicators or who’s behind it. Shadowserver tracks more than 51,000 ASA SSL VPN devices exposed online.
What to do
- Upgrade to a fixed release from Cisco’s advisory.
- If you can’t yet, BleepingComputer says disabling secondary authentication on DefaultWEBVPNGroup and any custom tunnel groups mitigates it.
My take
This is the third actively exploited ASA/FTD zero-day in about a year. Firewalls on the edge keep getting hit, so patch fast.
God Bless, and Needs Garlic!
