Cisco Patches Second ASA SSL VPN Zero-Day Used for Unauthenticated DoS Since August

The vulnerability affects tunnel groups using secondary auth on unpatched ASA and FTD releases. Exploitation requires only network reachability to the SSL VPN service; no valid login is needed. Cisco learned of in-the-wild use in October via a TAC case and credited researcher Eric Fernald. No actor attribution or attack telemetry was released. Workarounds include disabling the tunnel group list or secondary auth, though the latter reduces security posture.

This marks the second such zero-day in four months after CVE-2026-20349, which also enabled remote unauthenticated reloads via the same service. Both surfaced through support channels rather than coordinated disclosure. Procurement records and prior Cisco advisories show persistent exposure in enterprise and government VPN concentrators where secondary auth is mandated for compliance. The pattern suggests repeated logic errors in the SSL VPN processing path that attackers are locating faster than patches ship.

Independent scans from Shadowserver and Censys indicate tens of thousands of internet-facing ASA devices remain reachable. Absence of shared IOCs or actor details limits defensive correlation across incidents. Operators should prioritize upgrades over configuration changes given the repeated targeting of this exact attack surface.

Next steps include monitoring for follow-on exploitation of similar unauthenticated paths in remaining ASA code and tracking whether the same actor returns after the current patch window closes.