CVE-2026-76418: Cisco ASA and FTD SSL VPN flaw exploited to reload firewalls; fixes out

Cisco has patched CVE-2026-76418, a flaw in the Remote Access SSL VPN service of its Secure Firewall ASA and Firepower Threat Defense (FTD) software that lets an unauthenticated attacker make a firewall reload. Cisco's own security team says it is already being exploited. The advisory went out on 28 October 2026, and it is the second SSL VPN denial-of-service zero-day in these products since August. If your firewall terminates VPN users and uses a second authentication server, check it today.

Key points

• CVE-2026-76418 (CVSS 3.1 score 8.6, High) lets a remote, unauthenticated attacker force a Cisco ASA or FTD device to reload, cutting off VPN access.
• Cisco's PSIRT says it learned of active exploitation in October 2026; Cisco has not named attackers, victims or the scale.
• Only devices with webvpn enabled on an interface and secondary authentication set on a tunnel group are exposed, per Cisco's advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75.
• Fixed releases include ASA 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 and 9.24.1.27, and FTD 7.2.13, 7.4.9, 7.6.7 and 7.7.14.
• BleepingComputer cites Shadowserver tracking more than 51,000 internet-exposed Cisco ASA SSL VPN devices; how many are actually vulnerable is unknown.

What to do

Who is affected. Cisco Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software, when both of these are true:

1. The running configuration has webvpn with SSL VPN enabled on at least one interface (look for enable <interface_name> under webvpn).
2. A tunnel group uses secondary-authentication-server-group. If tunnel-group-list enable is present, check every tunnel group, including DefaultWEBVPNGroup. If the list is absent or disabled, check DefaultWEBVPNGroup.

Cisco says Cloud-delivered Firewall, cdFMC, Secure Access and Secure Firewall Management Center software are not affected.

Fixed releases (first fixed release, from Cisco's table):

Product	Affected train	First fixed
ASA	9.16 and earlier	9.16.4.104
ASA	9.18	9.18.4.96
ASA	9.20	9.20.4.50
ASA	9.22	9.22.3.200
ASA	9.23	9.23.1.48
ASA	9.24	9.24.1.27 and 9.24.10.1
FTD	7.0 and earlier	7.0.11
FTD	7.2	7.2.13
FTD	7.4	7.4.9
FTD	7.6	7.6.7
FTD	7.7	7.7.14
FTD	10.0	10.0.3
FTD	10.1	10.1.1

If you cannot patch yet. Cisco says no true workaround exists. It describes two mitigations that depend on your setup. If DefaultWEBVPNGroup does not use secondary authentication, running no tunnel-group-list enable in WebVPN configuration mode reduces exposure. If DefaultWEBVPNGroup does use it, no secondary-authentication-server-group removes the trigger but, in Cisco's words as reported by SecurityWeek, lowers the security of remote access VPN logins. Cisco recommends upgrading rather than relying on either.

How to check. Review the running configuration for the two conditions above, then compare your software version with the table. A firewall that reloads without explanation, especially more than once, is worth investigating together with VPN connection logs. Cisco has published no indicators of compromise, so absence of evidence is weak comfort.

What happened

On 28 October 2026 at 19:15 GMT Cisco published the advisory titled "Remote Access SSL VPN Tunnel Denial of Service Vulnerability" for ASA and FTD software, tracked as CVE-2026-76418 with Cisco bug ID CSCwx26625 and weakness type CWE-690. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H: reachable over the network, low complexity, no privileges, no user interaction, a changed scope, and a high impact on availability only.

The cause, according to Cisco, is logic errors that affect tunnel groups configured with secondary authentication. An attacker sends a crafted request to the SSL VPN service and the device reloads. Cisco states that "A successful VPN login is not required to reach the affected processing path", which is why the attacker needs no credentials at all.

Cisco's Product Security Incident Response Team (PSIRT) became aware of active exploitation in October 2026. The advisory does not say who is behind it, who was hit, or how many devices were affected. Cisco credits Eric Fernald, who found the flaw while resolving a Cisco TAC support case.

Background

This is not the first time this year that the same service has been used to knock these firewalls offline. SecurityWeek describes CVE-2026-76418 as the second Cisco firewall VPN zero-day exploited since August. The first, CVE-2026-20349, was an HTTP request handling flaw in the same Remote Access SSL VPN service that also let an unauthenticated attacker trigger a reload; Cisco patched it in August. SecurityWeek notes it is unclear whether the same attacker exploited both.

Edge devices such as VPN gateways are a favourite target because they sit on the internet, run with high privilege and are often patched slowly. We covered the earlier Cisco-related story of Volt Typhoon's Silent Train framework, which also involved Cisco infrastructure, though a different product line and a different weakness.

How it works

SSL VPN on an ASA or FTD lets remote users connect through a web-style login. Many organisations add a second authentication server on top of the first, for example a password check plus a one-time code from another system. In the ASA configuration that second check is the secondary-authentication-server-group setting on a tunnel group, which is the unit that defines how a class of VPN users connects.

The flaw sits in how the device handles requests that touch such a tunnel group. Because the vulnerable code runs before a login succeeds, anyone who can reach the VPN login page can try it. The result is a reload, not code execution or data theft: none of the sources we read describe either. For a company whose staff work remotely, though, a firewall that reboots on demand is a way to cut off VPN access whenever an attacker likes, and repeated reloads can also interrupt any other traffic the device handles.

The default group matters. If tunnel-group-list enable is configured, the device offers a list of groups on the login page, so every group is a possible entry point. If it is not, requests land on DefaultWEBVPNGroup. That is why Cisco tells admins to check every group in the first case and only the default in the second.

What it means

For network teams. The fix is a software upgrade across several release trains, and ASA upgrades usually need a maintenance window and a reload anyway. The ordering is therefore practical: confirm exposure with the two configuration checks, schedule the upgrade, and use the Cisco mitigations only as a stopgap. The no secondary-authentication-server-group option trades one risk for another, since it weakens login security, so it needs a decision from whoever owns VPN policy.

For security teams. Exploitation is confirmed by the vendor but the public detail is thin: no indicators, no named victims. Sensible monitoring is unexpected reloads, crash files and spikes of unauthenticated requests to the SSL VPN endpoint, plus a check that the management plane is not exposed to the internet.

For the wider industry. Two exploited SSL VPN denial-of-service bugs in about three months, in the same service, suggest attackers are probing this code path. Whether one actor or several are involved is not known.

What we don't know yet

• Who is exploiting the flaw, and whether the attacker is the same as in the August CVE-2026-20349 attacks. SecurityWeek says that is unclear.
• How many devices have been hit. Cisco has shared no victims or scale.
• How many of the roughly 51,000 internet-exposed ASA SSL VPN devices Shadowserver tracks use secondary authentication and are actually vulnerable. BleepingComputer itself says it is unknown how many are patched or are honeypots.
• Whether the reload can be turned into anything worse. The sources describe only a denial of service.
• Whether CISA will add the CVE to its Known Exploited Vulnerabilities catalogue; the articles we read do not mention it.

What to watch next

Watch for CISA action, for Cisco updating the advisory with indicators or new fixed releases, and for security firms publishing attack telemetry. Also watch whether researchers publish a proof of concept, which usually increases the number of attackers within days.

Sources

• Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 (primary source)
• BleepingComputer: New Cisco firewall zero-day exploited to crash SSL VPN devices
• SecurityWeek: Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
• GBHackers: Cisco Patches Actively Exploited SSL VPN Vulnerability Affecting ASA and FTD Firewalls