Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August

Cisco on Wednesday released fixes for an exploited vulnerability affecting its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software.

Tracked as CVE-2026-76418 and assigned a CVSS score of 8.6, the bug resides in the Remote Access SSL VPN service. Attackers can exploit it remotely, without authenticating, to force the device to restart unexpectedly and disrupt its availability.

Cisco attributes the issue to logic errors affecting tunnel groups configured with secondary authentication. Exploitation involves a malicious request sent while connecting to the SSL VPN.

“A successful VPN login is not required to reach the affected processing path,” Cisco noted.

For an attack to work, the firewall must be running an unpatched release, have its SSL VPN login service reachable, and use secondary authentication in an affected tunnel group. The company’s cloud-delivered firewall and management offerings, Secure Access, and the Secure Firewall Management Center are not vulnerable.

Cisco’s product security team learned in October that the flaw was being exploited in the wild. No information has been shared the attacks or the threat actors behind them.

The vulnerability came to light during a Cisco TAC support case, and the company credited Eric Fernald with finding it.

No workarounds are available. Depending on the default tunnel group’s settings, customers can reduce their exposure by turning off the tunnel group list or removing secondary authentication. Cisco cautioned that dropping secondary authentication makes remote access VPN less secure, and it recommends upgrading instead.

This is the second ASA and FTD zero-day exploited for DoS attacks in recent months. In August, Cisco released fixes for CVE-2026-20349 , an HTTP request processing flaw that also lets unauthenticated attackers remotely trigger a reload through the Remote Access SSL VPN service.

Cisco did not disclose details on those attacks either. It’s unclear whether both flaws were exploited by the same threat actor.

Related : Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Related : Hackers Start Probing Fresh Oracle EBS Vulnerability

Related : China-Linked Hackers Exploit PHP2Shell to Root Firewalls

Artificial Intelligence

Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps

Cisco open sourced Project Quarry, a rule language for detecting AI agent attacks that only emerge across sequences of benign actions.

Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

The flaws could lead to arbitrary code execution, authorization bypasses, and privilege escalation.

Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed.

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

CVE-2026-41709 allows attackers with administrative privileges to perform operations without being logged.

Chrome and Firefox Updates Patch Over 200 Vulnerabilities

The Chrome 156 update fixes 52 bugs, while Firefox 159 was rolled out with 167 security patches.

TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices

FoxIO disclosed three GoAhead TLS bugs that can let revoked certificates through or expose some encrypted sessions to eavesdroppers.

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization.

Long-Hidden Flaws Patched in EPICS Research Facility Control Software

Four EPICS Base flaws found by an autonomous system could let attackers crash processes at particle accelerators and fusion labs.