Skip to content
Cisco SSL VPN Denial of Service Vulnerability Exploited in the Wild

Cisco SSL VPN Denial of Service Vulnerability Exploited in the Wild

First seen 29 Oct 2026, 04:37 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 06:08 UTC
  • •CVE-2026-76418 allows DoS via SSL VPN on Cisco devices.
  • •Exploitation confirmed in the wild, with high risk rating.
  • •Cisco has released patches; no workarounds are available.

A vulnerability identified as CVE-2026-76418 in Cisco Secure Firewall ASA and FTD Software allows unauthenticated remote attackers to trigger a denial of service (DoS) condition. This flaw arises from logic errors when secondary authentication is configured on a tunnel group. Attackers can exploit this by sending crafted requests to the SSL remote access VPN, causing affected devices to reload unexpectedly. Cisco has released patches to address this vulnerability, but there are no workarounds available. The risk level is rated as high due to confirmed exploitation in the wild. Organizations using vulnerable versions are urged to apply the updates promptly to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-28
CVE-2026-76418 published
Cisco disclosed a vulnerability allowing DoS via SSL VPN, affecting ASA and FTD Software.
Sec.Cloudapps.Cisco
2026-10-29
Exploitation confirmed in the wild
Reports indicate that CVE-2026-76418 is actively being exploited, prompting urgent action from affected organizations.
Hkcert

More articles in this cluster (5)

Following this threat?

Track CVE-2026-76418 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 2

Common questions

Which Cisco products are affected?
The vulnerability affects Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Software.
What is the risk level of this vulnerability?
The risk level is rated as high due to confirmed exploitation in the wild.
What should organizations do to protect themselves?
Organizations should apply the patches released by Cisco immediately, as there are no workarounds available.