Zero Radar
← feed
CriticalVulnerabilityCVE-2026-76418updated 30 Oct 2026, 04:28 UTC

Cisco ASA and FTD firewalls can be crashed remotely through their VPN service

Attackers can send a specially crafted request to a Cisco firewall's VPN login page and make it restart, cutting off network access. Attacks are already happening in the wild.

Exploited (The Hacker News, BleepingComputer)Fix availableOfficial, 7 sources
SeverityCriticalCVSS 8.6 of 10
Being exploited?YesConfirmed by The Hacker News, BleepingComputer, CISA KEV, NVD · 29 Oct 2026
Fix available?YesSoftware updates released by Cisco (see Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for fixed versions). No workarounds exist. · since 28 Oct 2026
How sure is this?Official, 7 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCrafted request to the SSL VPN login
  2. 2Request reaches firewallRemote access VPN service is exposed
  3. 3Logic error triggersSecondary authentication path mishandles return value
  4. 4Firewall reloadsUnexpected restart causes denial of service
  5. ResultFirewall goes down, network access lost

What happened

A logic error in the Remote Access SSL VPN service, triggered when secondary authentication is configured on a tunnel group, causes an unchecked return value to lead to a NULL pointer dereference and an unexpected device reload. CISA lists it as an actively exploited issue.

Why it is dangerous: Organizations whose firewalls are exposed to the internet can lose VPN and network connectivity for remote staff and possibly other traffic. Successful attacks cause repeated denial of service.

Are you affected?

You are affected if your Cisco ASA or Secure Firewall Threat Defense (FTD) device runs Remote Access SSL VPN with secondary authentication configured on a tunnel group.

Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software with Remote Access SSL VPN and secondary authentication on a tunnel group. Specific versions: unknown from the provided material.

What to do

  1. Check whether Remote Access SSL VPN with secondary authentication is configured on any tunnel group in your ASA or FTD devices.
  2. Update ASA and FTD software to the fixed release listed in Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75.
  3. Prioritize internet-exposed devices, following CISA BOD 26-04 patching guidance.
  4. Review device logs for unexpected reloads or suspicious SSL VPN connection attempts.

Timeline

  1. 28 Oct 2026, 16:00 UTC
    Publicly disclosed
  2. 28 Oct 2026, 16:00 UTC
    Reported by Cisco PSIRT · Cisco PSIRT
  3. 28 Oct 2026, 19:17 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 20:22 UTC
    NVD reported on it · NVD
  5. 29 Oct 2026, 09:55 UTC
    SecurityWeek reported on it · SecurityWeek
  6. 29 Oct 2026, 11:07 UTC
    The Hacker News reported on it · The Hacker News
  7. 29 Oct 2026, 11:07 UTC
    Reported by The Hacker News
  8. 29 Oct 2026, 11:11 UTC
    BleepingComputer reported on it · BleepingComputer
  9. 29 Oct 2026, 14:04 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)
  10. 29 Oct 2026, 19:15 UTC
    CISA KEV reported on it · CISA KEV
  11. 29 Oct 2026, 19:15 UTC
    Confirmed by CISA KEV
  12. 29 Oct 2026, 19:15 UTC
    Severity raised to critical

Sources 7 reports, oldest first

Official vendor, government CERT or advisory database

Security press established security newsrooms

Technical details

ID
CVE-2026-76418 · ZR-77f4fed6
CVSS
8.6 / 10
Disclosed
28 Oct 2026, 16:00 UTC
On Zero Radar
28 Oct 2026, 19:17 UTC (3 h after disclosure)
Last change
30 Oct 2026, 04:28 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Cisco ASA and FTD firewalls can be crashed remotely through their VPN service · Zero Radar