Cisco ASA/FTD zero-day exploited to crash SSL VPN devices

Thu, 29 Oct 2026 17:24:45 +0000

Engineer — Act: Cisco confirmed active exploitation of this DoS zero-day in ASA and FTD software — apply Cisco’s security updates to affected ASA/FTD appliances immediately, prioritizing internet-facing SSL VPN interfaces.
SOC/IR — Plan: No IOCs are published yet, but active exploitation warrants building or enabling alerts on unexpected Cisco ASA/FTD device reboots or SSL VPN process crashes, which will be the observable symptom of exploitation attempts.
Leader — Plan: Confirm whether Cisco ASA or FTD is deployed in your environment and verify that engineering has elevated this patch to critical priority; successful exploitation takes down VPN access, posing a business-continuity risk.

Cisco-Asa on CuraSec