Cisco firewall zero-day CVE-2026-76418 actively exploited

A high-severity flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD is being actively exploited to crash devices. CVE-2026-76418 is rated 8.6 and lets an unauthenticated attacker trigger a device reload; Cisco released fixes for ASA 9.16–9.24 and FTD 7.0–10.1 and offers no workaround.

• CVE-2026-76418 rated 8.6 causes device reload via SSL VPN
• Configs with webvpn and SSL VPN on any interface are vulnerable
• Fixes in ASA 9.16.4.104–9.24.10.1 and FTD 7.0.11–10.1.1
• Temporary mitigation: disable secondary authentication on tunnel groups