Cisco has issued a critical update for its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software to address a vulnerability actively exploited in the wild. The vulnerability, identified as CVE-2026-76418, carries a CVSS score of 8.6 and affects the Remote Access SSL VPN service. This flaw allows attackers to remotely trigger a device restart without needing authentication, which can lead to significant service disruption.

The issue stems from logic errors in the handling of tunnel groups that use secondary authentication. To exploit this vulnerability, an attacker sends a malicious request during an SSL VPN connection attempt. The firewall must be running an unpatched version of the software, have the SSL VPN login service accessible, and use secondary authentication in an affected tunnel group for the attack to succeed. Notably, Cisco's cloud-based firewall services and management offerings are not impacted by this flaw.

Cisco discovered the vulnerability following a support case and credited Eric Fernald for its identification. The company is aware that this vulnerability is being exploited but has not released details about the attackers or the nature of the attacks. There are no available workarounds, but Cisco advises that disabling the tunnel group list or secondary authentication can temporarily reduce exposure. However, this might decrease VPN security, and Cisco strongly recommends applying the patch.

This marks the second zero-day vulnerability in Cisco's ASA and FTD software exploited for denial-of-service attacks in recent months. In August, Cisco patched another vulnerability, CVE-2026-20349, which similarly allowed remote, unauthenticated attackers to disrupt services through the Remote Access SSL VPN function. Cisco has not disclosed if the same threat actors are responsible for exploiting both vulnerabilities.