Cisco ASA and FTD SSL VPN flaw CVE-2026-76418 exploited to force firewall reloads
A crafted request to the VPN login, with no sign-in needed, makes the firewall reload. Devices are exposed when secondary authentication is configured on a tunnel group, and the stopgap Cisco offers weakens VPN sign-in until the upgrade.
Affects
Secure Firewall ASA Software
What to do
Upgrade every ASA and FTD firewall running remote access VPN to Cisco's first fixed release today.
- KEV listed
- CVE
- CVE-2026-76418
- CVSS
- 8.6 (v3.1, Cisco)
- Exploitation
- Exploited, in the CISA catalogue
- Affected
- Secure Firewall ASA Software 9.16 and earlier, 9.18, 9.20, 9.22, 9.23 and 9.24 before the first fixed release
- Secure FTD Software 7.0 and earlier, 7.2, 7.4, 7.6, 7.7, 10.0 and 10.1 before the first fixed release
- Fixed in
- ASA 9.16.4.104
- ASA 9.18.4.96
- ASA 9.20.4.50
- ASA 9.22.3.200
- ASA 9.23.1.48
- ASA 9.24.1.27
- ASA 9.24.10.1
- FTD 7.0.11
- FTD 7.2.13
- FTD 7.4.9
- FTD 7.6.7
- FTD 7.7.14
- FTD 10.0.3
- FTD 10.1.1
How the flaw works
An attacker needs no credentials, only network reach to the SSL remote access VPN login. A crafted request triggers logic errors where secondary authentication is configured on a tunnel group, and the device reloads. A successful VPN login is not required to reach the affected processing path.
What to do now
Devices with secondary authentication on DefaultWEBVPNGroup go first, because disabling the tunnel group list does not remove their exposure.
- Check each running configuration for the webvpn keyword with SSL VPN enabled on an interface
- Check every tunnel group, including DefaultWEBVPNGroup, for secondary-authentication-server-group
- Use the Cisco Software Checker to find the first fixed release for each device
- If the upgrade must wait and DefaultWEBVPNGroup lacks secondary authentication, disable the tunnel group list with no tunnel-group-list enable
- If DefaultWEBVPNGroup uses secondary authentication, remove it with no secondary-authentication-server-group
- Upgrade using the Cisco Secure Firewall ASA Upgrade Guide for ASA and the Secure FMC upgrade guide for FTD
Who is affected
A device is exposed when it runs a vulnerable release, the SSL remote access VPN login service is reachable, and secondary authentication is configured in the tunnel group scope. On FTD, review the deployed remote access VPN policy in Secure FMC or Secure FDM. Cisco confirms Cloud-delivered Firewall, cdFMC, Secure Access and Secure FMC Software are unaffected.
Cisco states there is no workaround and offers a mitigation, and CISA set US federal agencies a deadline of 1 November.
Detection notes
Cisco became aware of active exploitation in October 2026. A successful exploit reloads the device, and CISA points federal agencies to its Forensics Triage Requirements.
- Firewall reloads that nobody on the team scheduled
- VPN drops reported by remote staff as a device restarts
- Reloads that follow an SSL VPN connection attempt on a device whose tunnel groups use secondary authentication
Essential Eight mapping
Patch applications: the Essential Eight Maturity Model sets 48 hours for internet-facing network devices where a working exploit exists, and Cisco reports active exploitation. Multi-factor authentication: Cisco's mitigation lowers the security posture for remote access VPN, so keep it as a short bridge to the upgrade.
Sources
- PrimaryCISA, Known Exploited Vulnerabilities Catalog (release 2026.10.30)Retrieved 31 Oct 2026
- PrimaryCisco, Secure Firewall ASA and FTD Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability (cisco-sa-asaftd-tunnel-dos-s6mgkb75, 28 October 2026)Retrieved 31 Oct 2026
- PrimaryNVD, CVE-2026-76418Retrieved 31 Oct 2026
- PrimaryASD, Essential Eight Maturity ModelRetrieved 29 Oct 2026
