New Cisco firewall zero-day exploited to crash SSL VPN devices

Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices.

Tracked as CVE-2026-76418, this high-severity vulnerability affects devices running ASA and FTD software with configurations containing the 'webvpn' keyword and SSL VPN enabled on at least one interface.

Successful exploitation allows unauthenticated, remote attackers to trigger a denial-of-service (DoS) condition, causing the device to reload unexpectedly.

Cisco advised customers to patch vulnerable firewalls after its Product Security Incident Response Team (PSIRT) discovered evidence that the flaw was being exploited in the wild earlier this month. However, the company didn't provide indicators of compromise and hasn't shared additional information about the attacks, including which organizations are being targeted or who is exploiting the flaw.