Cisco Patches Actively Exploited DoS Zero-Day in ASA and Threat Defense Software
Remote crash vulnerability affects SSL VPN devices globally
Key Takeaways
- Cisco has released patches for an actively exploited denial-of-service zero-day in ASA and FTD software.
- Attackers are using the vulnerability to remotely crash SSL VPN firewall devices.
- The CVE number and full exploit methodology have not been publicly disclosed.
- Immediate patching is recommended for all affected devices.
Quick answers
- What happened?
- Cisco has released security updates to address a denial-of-service zero-day vulnerability in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software. Attackers are actively exploiting the flaw to remotely crash vulnerable firewall devices, disrupting SSL VPN services. The company has not disclosed the CVE number or full exploit details in the initial advisory.
- Which products are affected?
- Adaptive Security Appliance (ASA), Threat Defense (FTD)
- What should defenders do?
- Apply Cisco security updates immediately. Administrators should verify current software versions and update to the latest patched releases to eliminate the vulnerability. Monitor Cisco security advisories for additional details.
Cisco has released security updates to patch a denial-of-service zero-day vulnerability affecting Adaptive Security Appliance (ASA) and Threat Defense (FTD) software. According to reporting from BleepingComputer, threat actors are exploiting the flaw to remotely crash vulnerable firewall devices. The exploitation targets SSL VPN infrastructure, potentially causing widespread service disruption. Cisco has not provided the CVE identifier or detailed technical information about the exploit mechanism in the initial release. Users are strongly advised to apply the released patches immediately to mitigate the risk of denial-of-service attacks. The vulnerability impacts global deployments of the affected software versions.
Security Details
Cisco has released security updates to address a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software. Attackers are exploiting the vulnerability to remotely crash SSL VPN devices. The company has not disclosed the CVE number or full exploit details.
Affected products
Adaptive Security Appliance (ASA), Threat Defense (FTD)
Mitigation
Apply Cisco security updates immediately. Administrators should verify current software versions and update to the latest patched releases to eliminate the vulnerability. Monitor Cisco security advisories for additional details.
Sources
BleepingComputer
New Cisco firewall zero-day exploited to crash SSL VPN devices
Oct 29, 2026 · 11:10
Original link
Related Security News
.jpg)
Proof-of-Concept Released for Android "SMS of Death" Vulnerability
A security researcher has released proof-of-concept code for CVE-2026-58882, an Android vulnerability that can be triggered by sending a specially crafted text message. The exploit may allow attackers to remotely disrupt cellular service or crash unpatched devices. Google and device manufacturers have released security updates to address the flaw. The researcher's identity remains undisclosed in the reporting source.
