--- title: "Cisco ASA VPN zero-day reboots firewalls; the second exploited since August" summary: "Cisco’s 28 October advisory for its ASA and FTD firewalls, CISA’s 3-day listing, CERT-In’s 2 November note and the August flaw before it: what is confirmed as of 2 November." url: https://www.thetechbag.com/blog/cisco-asa-ftd-vpn-zero-day-exploited format: Note desk: "Security" area: "Network & cloud" region: Global published: 2026-11-02 facts_checked: 2026-11-02 author: TechBag (The TechBag Journal) tags: ["Cisco","Cisco Secure Firewall","ASA","FTD","SSL VPN","CVE-2026-76418","CVE-2026-20349","zero-day","denial of service","CISA KEV","BOD 26-04","CERT-In"] cover: https://www.thetechbag.com/blog/covers/cisco-asa-ftd-vpn-zero-day-exploited.png --- # Cisco ASA VPN zero-day reboots firewalls; the second exploited since August *Cisco’s 28 October advisory for its ASA and FTD firewalls, CISA’s 3-day listing, CERT-In’s 2 November note and the August flaw before it: what is confirmed as of 2 November.* Note · Security · Network & cloud · By TechBag · Published 2026-11-02 · Facts checked 2026-11-02 · Canonical: https://www.thetechbag.com/blog/cisco-asa-ftd-vpn-zero-day-exploited Attackers are exploiting CVE-2026-76418, a flaw that lets anyone who can reach the SSL VPN login of a Cisco Secure Firewall ASA or FTD device make it reload, without signing in. Cisco published the advisory and fixed releases on 28 October at 19:15 GMT (00:45 on 29 October in India); its first version already said Cisco’s security team had seen “active exploitation” in October.[1] CISA added the flaw to its catalogue of exploited vulnerabilities on 29 October with a due date of 1 November.[2] CERT-In followed on 2 November.[3] It is the second exploited ASA and FTD VPN flaw since 11 August.[4] ## What Cisco confirmed: a forced reload, on one configuration Cisco rates the flaw High, CVSS 3.1 base score 8.6. The cause is “logic errors when secondary authentication is configured on a tunnel group”; a crafted request sent while connecting to the SSL remote access VPN reloads the device. The score’s vector puts confidentiality and integrity impact at none and availability at high: the advisory describes an outage, not a break-in.[1] A device is exposed only when all three hold, by Cisco’s account:[1] - it runs an affected ASA or FTD release with SSL VPN (`webvpn`) enabled on at least one interface; - the SSL VPN login service is reachable; - secondary authentication is set on a tunnel group, including the default `DefaultWEBVPNGroup`, whether or not that group appears on the login page. “A successful VPN login is not required” to reach the faulty code. Cisco lists Cloud-delivered Firewall, its cloud-delivered management center, Secure Access and Secure FMC as not affected. It gives no workaround, names no attacker and gives no count of affected customers.[1] ReportedReported, not counted by us BleepingComputer, citing Shadowserver’s dashboard on 29 October, reported more than 51,000 Cisco ASA SSL VPN devices exposed online.[6] That counts exposed VPN logins, not vulnerable devices: by BleepingComputer’s account Shadowserver does not say how many are already secured, and the flaw also needs secondary authentication on a tunnel group. We could not read the dashboard’s figure ourselves. ## The second time since August On 11 August Cisco disclosed CVE-2026-20349, also an unauthenticated reload through the remote access VPN, also CVSS 8.6, also exploited in August, also with no workaround. CISA listed it the same day.[4][2] Cisco first shipped hot fixes, then on 16 September pointed customers to “hardening releases” that carry the fix and other internally found flaws.[4] **Figure: Two exploited ASA and FTD VPN flaws in 11 weeks, each with a 3-day federal deadline** *Cisco advisories, CISA KEV listings and due dates, and CERT-In notes, 11 August to 2 November 2026* | Date | Event | Detail | | --- | --- | --- | | 11 Aug 2026 | CVE-2026-20349 | Cisco advisory; CISA lists it the same day | | 14 Aug 2026 | KEV due date | 3 days after listing | | 17 Aug 2026 | CERT-In CIVN-2026-0411 | rated High | | 16 Sept 2026 | Cisco updates fixes | hardening releases replace hot fixes | | 28 Oct 2026 | CVE-2026-76418 | Cisco advisory, exploited | | 29 Oct 2026 | CISA lists it | KEV | | 1 Nov 2026 | KEV due date | 3 days after listing | | 2 Nov 2026 | CERT-In CIVN-2026-0534 | rated High | Source: Cisco PSIRT advisories; CISA KEV catalogue (feed version 2026.10.30); CERT-In vulnerability notes · as of 2 November 2026 · KEV due dates bind US federal civilian agencies under BOD 26-04; they are not a deadline for anyone else. TechBag countTechBag count, CISA KEV feed to 30 October Of 282 entries CISA added in 2026, 20 are Cisco’s, second to Microsoft’s 40. Five of the 20 are in the firewall line: three in Firewall Management Center (19 March, 29 July, 9 September) and the two ASA and FTD flaws. Since 2021 the catalogue has listed 15 ASA or FTD flaws. And in every one of the 13 release trains Cisco lists, the first release fixed for October’s flaw is later than August’s (ASA 9.20: 9.20.4.49 then 9.20.4.50): a device patched in August still needs October’s build. ## What Cisco says to do Upgrade to a fixed release. Cisco’s first fixed releases for CVE-2026-76418:[1] - ASA: 9.16.4.104 (9.16 and earlier), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1. - FTD: 7.0.11 (7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1. Until then Cisco offers a mitigation it calls temporary: if `DefaultWEBVPNGroup` has no secondary authentication, turn off the tunnel group list (`no tunnel-group-list enable`), and users must then know their connection profile; if it does, remove it (`no secondary-authentication-server-group`), which Cisco says lowers the VPN’s security posture.[1] Not yet known: who is exploiting the flaw, against whom, and whether the reloads came alone or with other activity. In India CERT-In’s note CIVN-2026-0534 of 2 November rates the flaw High and lists the same release trains; it does not say the flaw is exploited.[3] Its August note came six days after Cisco’s advisory; this one five.[5] Annexure I of CERT-In’s Directions of 28 April 2022 lists “Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks” among incidents a body corporate must report within 6 hours of noticing.[8] Cisco Secure Firewall is in TechBag’s catalogue: see the [Cisco Secure Firewall page](https://www.thetechbag.com/cisco/cisco-secure-firewall). How we did this Figures as of 2 November 2026 Advisory facts and fixed releases are from Cisco’s pages, checked against their text. KEV dates and every KEV count are ours, from CISA’s JSON feed (version 2026.10.30, 1,766 entries), counting by `dateAdded`; “firewall line” means ASA, FTD and Firewall Management Center entries. CISA’s deadline rule is explained in [our piece on BOD 26-04](https://www.thetechbag.com/blog/cisa-exploited-flaw-deadline-21-days-to-3).[7] The exposure figure is reported, not ours. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Cisco, Secure Firewall ASA and FTD Remote Access SSL VPN Tunnel Denial of Service Vulnerability (cisco-sa-asaftd-tunnel-dos-s6mgkb75, CVE-2026-76418)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75) — 28 October 2026 2. [CISA, Known Exploited Vulnerabilities catalogue, JSON feed (CVE-2026-76418 added 29 October; CVE-2026-20349 added 11 August)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — 30 October 2026 3. [CERT-In, Vulnerability Note CIVN-2026-0534: Denial of Service Vulnerability in Cisco product](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0534) — 2 November 2026 4. [Cisco, Secure Firewall ASA and FTD Remote Access SSL VPN Denial of Service Vulnerability (cisco-sa-asaftd-vpn-dos-dzv4mQFF, CVE-2026-20349; v1.1 16 September)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF) — 11 August 2026 5. [CERT-In, Vulnerability Note CIVN-2026-0411: Remote Access SSL VPN Denial-of-Service Vulnerability in Cisco Product](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0411) — 17 August 2026 6. [BleepingComputer, New Cisco firewall zero-day exploited to crash SSL VPN devices (Shadowserver figure)](https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/) — 29 October 2026 7. [CISA, BOD 26-04: Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk) — 10 June 2026 8. [CERT-In, Directions under section 70B(6) of the IT Act, 2000 (direction (ii) and Annexure I: six-hour reporting)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 Related on TechBag: the [firewall guide](https://www.thetechbag.com/browse/network-security-sase/firewall-network-security) and [SSL VPN or IPsec VPN](https://www.thetechbag.com/blog/ssl-vpn-ipsec-vpn-which-one-right). **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Cisco intel hub](https://www.thetechbag.com/cisco) — Secure Firewall, Secure Access and the rest of Cisco's security line - [Firewall and network security guide](https://www.thetechbag.com/browse/network-security-sase/firewall-network-security) — how the NGFW vendors compare - [SSL VPN or IPsec VPN](https://www.thetechbag.com/blog/ssl-vpn-ipsec-vpn-which-one-right) — exploited flaws counted by VPN component