What happened

• Cisco PSIRT reports in-the-wild exploitation of CVE-2026-76418, a DoS flaw in ASA and FTD SSL VPN (webvpn) [S1].
• The flaw stems from logic errors when secondary authentication is configured on a tunnel group [S1].
• An unauthenticated remote attacker can send a crafted request to the SSL remote access VPN and force the device to reload [S1].
• Cisco has released patches, but published no IoCs and no details on attackers or targets [S1].
• SecurityWeek describes this as the second exploited Cisco firewall VPN zero-day since August [S2].

Timeline

Detect

Unexpected ASA/FTD reloads without an operator reload command · Cisco ASA/FTD syslog

index=* ("%ASA-" OR "%FTD-") ("199005" OR "199002" OR "111008" OR "199001") | eval evt=case(searchmatch("199005"),"startup_begin",searchmatch("199002"),"startup_complete",searchmatch("111008") OR searchmatch("199001"),"admin_reload") | bin _time span=1h | stats values(evt) as events count by host _time | where isnull(mvfind(events,"admin_reload")) AND isnotnull(mvfind(events,"startup_begin"))

FROM logs-* | WHERE (message LIKE "*%ASA-*" OR message LIKE "*%FTD-*") AND (message LIKE "*199005*" OR message LIKE "*199002*" OR message LIKE "*111008*" OR message LIKE "*199001*") | EVAL evt = CASE(message LIKE "*199005*", "startup_begin", message LIKE "*199002*", "startup_complete", message LIKE "*111008*" OR message LIKE "*199001*", "admin_reload", null) | EVAL hour = DATE_TRUNC(1 hour, @timestamp) | STATS events = VALUES(evt), count = COUNT(*), begins = COUNT(CASE(evt == "startup_begin", 1, null)), reloads = COUNT(CASE(evt == "admin_reload", 1, null)) BY host.name, hour | WHERE reloads == 0 AND begins > 0 | DROP begins, reloads | SORT hour DESC

A hit means: A firewall restarted with no operator reload logged in the same hour. On a webvpn-enabled device this matches the reported exploitation outcome (forced reload) [S1]. It is a lead, not proof: confirm with crash files and VPN logs.

Verify

• Pull 'show crashinfo' or the crash file from the device and check whether the reload was a crash rather than a planned restart; share it with Cisco TAC to tie it to CVE-2026-76418.
• Confirm the device has SSL VPN enabled and secondary authentication on a tunnel group; without both, the reported condition does not apply [S1].
• Benign look-alikes: change-window reloads, upgrades, HA failover, power or hardware faults, and crashes from other known bugs.

Scope

Affected

• Cisco ASA and FTD software with 'webvpn' configuration and SSL VPN enabled on at least one interface (CVE-2026-76418) [S1]

Only if

• SSL VPN enabled on at least one interface
• Secondary authentication configured on a tunnel group

Not affected if

• Secondary authentication not configured on any tunnel group

Enumerate

• All ASA and FTD devices, with software version and management owner
• Which devices have webvpn / SSL VPN enabled on any interface
• Which tunnel groups have secondary authentication configured
• Reload and crash history on those devices since August 2026

Contain

• Apply Cisco's fixed release to exposed devices first; check the Cisco advisory for the exact versions.
• If patching must wait, check the Cisco advisory for any supported mitigation. Do not improvise configuration changes to remote access VPN without it.
• Before patching or reloading a device that crashed, collect crash files and syslog; an upgrade or reload can overwrite them and that cannot be undone.

Eradicate

• The sources describe a DoS with no persistence or post-exploitation activity. Removal is the software update [S1].

Recover

• After upgrading, validate the running version, VPN login with secondary auth, and HA state.
• Monitor for further unplanned reloads; a reload on a patched device means the fix or the scope is wrong.

Re-enter the loop when

• Cisco or another source publishes IoCs, attacker details or crafted-request signatures.
• Reporting links CVE-2026-76418 to follow-on activity such as code execution or persistence.
• Cisco updates the advisory with new affected versions, configurations or products.
• A patched device keeps reloading unexpectedly.
• The earlier August zero-day [S2] proves to be chained with this one.

Debrief

• Record affected device count, patch times, and any unplanned reloads with crash evidence.
• Gap: no IoCs, attacker or target details from Cisco [S1].
• Gap: fixed versions and any workaround are not in the provided sources.
• Gap: whether the DoS was used to cover or enable other activity is unknown.

Detection coverage — checked automatically

Checked automatically 2026-11-10 22:22Z from public sources: 5 published, 22 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2026-76418 — Cisco ASA/FTD zero-day CVE-2026-76418 actively exploited for remote DoS crashes of SSL VPN devices; patches released. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2026-76418

cpe:"cpe:/a:cisco:secure_firewall_threat_defense"

product:"Secure Firewall Threat Defense"

host.services: (software.product = "Secure Firewall Threat Defense")

ssl:"Cisco Firepower"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

Banner spellings: a model read 4 from the NVD names and this card's text (former and marketing names, console titles); 1 matched something on Shodan and is shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 22:22Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• Is CVE-2026-76418 in CISA KEV? The brief context says so, but neither source confirms it.
• Which software releases fix the flaw, and does Cisco offer a workaround?
• What is the Cisco advisory ID and CVSS score?
• Does this relate to the earlier August zero-day mentioned by SecurityWeek [S2]?

Sources

• [S1] https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/ · BleepingComputer
• [S2] https://www.securityweek.com/attackers-exploit-second-cisco-firewall-vpn-zero-day-since-august/ · SecurityWeek

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.