Cisco Firewalls Crash from SSL VPN Zero-day
Unauthenticated DoS crashes Cisco ASA/FTD SSL VPN devices; patches and workarounds are available.
Cisco reports an unauthenticated DoS zero‑day (CVE-2026-76418) that can crash ASA and FTD devices with SSL VPN enabled; exploitation was observed in the wild. Shadowserver reports over 51,000 internet-reachable ASA SSL VPN devices that could be affected, and Cisco urges customers to upgrade to fixed software or apply provided workarounds.
Context
Edge and management-plane devices are the current focus: internet-facing VPN/management interfaces and SD‑WAN controllers are being targeted, increasing risk to availability and lateral movement. Organizations with ASA/FTD, PAN‑OS management interfaces, SD‑WAN controllers, or internet-facing ESXi/vCenter instances should assume elevated exposure and validate customer-controlled device configs.
“Treat vendor advisories for network and hypervisor products as operational tasks with inbound urgency.”
Contrarian view
SitRep’s judgement from the cited reporting, not reported fact. Written by AI.
Exposed Management Surfaces Require Immediate Attention
Assuming vendor-managed services or cloud rollouts protect appliance exposure is risky; customer-controlled configs and internet-facing management/VPN endpoints require explicit actions to mitigate active attacks.
BleepingComputer · Palo Alto Networks Security Advisories · SecurityWeek