Cisco patches CVE-2026-76418 zero-day in ASA and FTD SSL VPNs

En bref

• CVE-2026-76418 affects Cisco Secure Firewall ASA and FTD remote-access SSL VPN deployments.
• Exploitation requires no credentials and can be launched over the network.
• Successful attacks could compromise the firewall appliance itself.
• It is the second actively exploited zero-day to hit Cisco firewalls since August.
• Cisco has published fixed releases; prioritize internet-facing VPN gateways.

Cisco on Wednesday issued software updates for a high-severity vulnerability, CVE-2026-76418, in its Secure Firewall ASA and FTD platforms, with the remote-access SSL VPN functionality specifically in scope. The company says the flaw is being exploited in the wild. Because the issue can be reached over the network and does not require valid credentials, an attacker could use it to gain a foothold on an affected appliance and potentially take control of the device.

The exposure is concentrated in organizations that terminate remote-access VPN sessions on Cisco ASA or FTD hardware. That includes many school districts, colleges, and government agencies that depend on these gateways for staff and student connectivity. Internet-facing VPN concentrators are attractive targets because they sit at the network edge and often bridge untrusted networks into sensitive internal systems.

This is the second actively exploited zero-day to hit Cisco's firewall line since August, a pattern that should raise concern for defenders. Edge devices are frequently probed and exploited at scale, and a flaw that needs no authentication shortens the time between disclosure and compromise. Even a single unpatched VPN gateway can become an entry point for lateral movement, credential theft, or disruption.

Cisco has released fixes, so administrators should confirm which releases are affected and move to a corrected version as soon as possible. Until patching is complete, teams should review the vendor advisory for workarounds, tighten access to VPN and management interfaces, and inspect logs for unusual sessions or device behavior. Watch for follow-up exploitation attempts and updated guidance as researchers analyze the vulnerability.

À faire maintenant

1. Inventory every Cisco Secure Firewall ASA and FTD device with remote-access SSL VPN enabled, and record current software versions.
2. Apply Cisco's fixed release for CVE-2026-76418 immediately, prioritizing internet-facing VPN gateways and management interfaces.
3. If immediate patching is not possible, follow Cisco's advisory workarounds and restrict VPN access to trusted sources where operationally feasible.
4. Review VPN, firewall, and device logs for anomalous authentication attempts, unusual sessions, or unexpected process behavior.
5. Rotate credentials and secrets on any appliance with suspected compromise, isolate it from the network, and rebuild if indicators are confirmed.
6. Limit administrative access to dedicated management networks with multi-factor authentication, and monitor Cisco advisories for updates.
7. Validate patch deployment across all affected devices and document emergency change records for audit purposes.

Références CVE

• CVE-2026-76418

Source originale

SecurityWeek