New Cisco firewall zero-day exploited to crash SSL VPN devices
Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices.
Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices.
Last year, Cisco patched two other flaws (CVE-2025-20362 and CVE-2025-20333) affecting ASA and FTD firewall devices in September and cautioned customers that attackers had exploited them in zero-day attacks targeting 5500-X Series devices with VPN web services enabled.
More recently, in August, Cisco addressed another denial-of-service zero-day vulnerability (CVE-2026-20349) that attackers were actively exploiting in the wild to crash affected ASA and FTD firewall devices with SSL listen sockets enabled.
Cisco advised customers to patch vulnerable firewalls after its Product Security Incident Response Team (PSIRT) discovered evidence that the flaw was being exploited in the wild earlier this month.
Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network.
Tracked as CVE-2026-76418 , this high-severity vulnerability affects devices running ASA and FTD software with configurations containing the 'webvpn' keyword and SSL VPN enabled on at least one interface.
Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability." While Cisco provided no workarounds that address this security issue, admins who can't immediately patch CVE-2026-76418 can mitigate it by disabling secondary authentication on the default DefaultWEBVPNGroup tunnel group or on any user-configured tunnel group list.
A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition," Cisco said .
Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild.
However, the company didn't provide indicators of compromise and hasn't shared further information about the attacks, including which organizations are being targeted or who is exploiting the flaw.
What happened
Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices.
Last year, Cisco patched two other flaws (CVE-2025-20362 and CVE-2025-20333) affecting ASA and FTD firewall devices in September and cautioned customers that attackers had exploited them in zero-day attacks targeting 5500-X Series devices with VPN web services enabled.
What changed
More recently, in August, Cisco addressed another denial-of-service zero-day vulnerability (CVE-2026-20349) that attackers were actively exploiting in the wild to crash affected ASA and FTD firewall devices with SSL listen sockets enabled.
Cisco advised customers to patch vulnerable firewalls after its Product Security Incident Response Team (PSIRT) discovered evidence that the flaw was being exploited in the wild earlier this month.
Who is affected
Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network.
Tracked as CVE-2026-76418 , this high-severity vulnerability affects devices running ASA and FTD software with configurations containing the 'webvpn' keyword and SSL VPN enabled on at least one interface.
Why it matters
Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability." While Cisco provided no workarounds that address this security issue, admins who can't immediately patch CVE-2026-76418 can mitigate it by disabling secondary authentication on the default DefaultWEBVPNGroup tunnel group or on any user-configured tunnel group list.
A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition," Cisco said .
Technical details
Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild.
However, the company didn't provide indicators of compromise and hasn't shared further information about the attacks, including which organizations are being targeted or who is exploiting the flaw.
Cisco linked the attacks to the ArcaneDoor campaign , which had also been exploiting two other zero-days (CVE-2024-20353 and CVE-2024-20359) to breach government networks since November 2023.
Response
Earlier this month, it also warned customers to patch an actively exploited zero-day (CVE-2026-76519) in its Secure Email Gateway (SEG) security solution that lets unauthenticated attackers execute commands remotely with root privileges.
Cisco's February remediation guide for this flaw warns that there could be "existing exploits which are still in place" from before an upgrade.
What security teams should do
Currently, Internet monitoring platform Shadowserver tracks more than 51,000 Cisco ASA SSL VPN devices exposed online, but doesn't provide information on how many have already been secured or are honeypots.
To check for exploitation of the flaw itself, Cisco says to look in /var/log/auth.log for Accepted publickey for vmanage-admin entries from unknown IP addresses.
What remains unknown
To check for exploitation of the flaw itself, Cisco says to look in /var/log/auth.log for Accepted publickey for vmanage-admin entries from unknown IP addresses.
Attribution
BleepingComputer: Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices.
The Hacker News: Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild.
The Hacker News: Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.