Security Digest · Oct 28, 2026 · Vulnerability · Network edge
Cisco ASA/FTD CVE-2026-76418: Exploited VPN Crash Bug
Unauthenticated reload of Cisco ASA and FTD SSL VPN when secondary authentication is set. Exploited in October. Fixed in new ASA/FTD builds; check your config.
Our verdict
Check exposure
Only ASA and FTD headends that offer SSL remote access VPN with secondary authentication can be crashed, but that is being done in the wild, so those devices should be upgraded this week.
Who must act: Teams whose Cisco ASA or FTD terminates SSL remote access VPN and has secondary-authentication-server-group set on a reachable tunnel group, including DefaultWEBVPNGroup.
Who can relax: Firewalls without SSL VPN enabled, VPN headends that use only a single authentication server, and Cisco's cloud-delivered firewall, cdFMC, Secure Access and Secure FMC, which Cisco lists as not vulnerable.
- Affected
- Cisco ASA 9.16 and earlier before 9.16.4.104
Cisco ASA 9.18 before 9.18.4.96
Cisco ASA 9.20 before 9.20.4.50
Cisco ASA 9.22 before 9.22.3.200
Cisco ASA 9.23 before 9.23.1.48
Cisco ASA 9.24 before 9.24.1.27
Cisco FTD 7.0 and earlier before 7.0.11
Cisco FTD 7.2 before 7.2.13
Cisco FTD 7.4 before 7.4.9
Cisco FTD 7.6 before 7.6.7
Cisco FTD 7.7 before 7.7.14
Cisco FTD 10.0 before 10.0.3
Cisco FTD 10.1 before 10.1.1 - Fixed in
- ASA 9.16.4.104
ASA 9.18.4.96
ASA 9.20.4.50
ASA 9.22.3.200
ASA 9.23.1.48
ASA 9.24.1.27 or 9.24.10.1
FTD 7.0.11
FTD 7.2.13
FTD 7.4.9
FTD 7.6.7
FTD 7.7.14
FTD 10.0.3
FTD 10.1.1 - CVSS
- 8.6 (v3.1, vendor)
- EPSS
- 0.8% (percentile 57)
- CISA KEV
- Yes, listed as known exploited
- Exploitation
- Exploited in the wild
- Severity
- High
What to do
- On each ASA and FTD, check for webvpn with an enabled interface and for secondary-authentication-server-group on any reachable tunnel group.
- Upgrade exposed devices to the first fixed release for their train, internet-facing VPN headends first.
- If you cannot upgrade yet and DefaultWEBVPNGroup has no secondary authentication, disable the tunnel group list with no tunnel-group-list enable.
- Remove secondary authentication only as a last resort and only after weighing the security loss, since it weakens VPN login.
- Alert on unexpected firewall reloads so a crash is investigated rather than just rebooted through.
How to check if you are affected or compromised
- Compare uptime in show version against your change log and check show crashinfo for unexplained reloads since early October.
- Correlate reload times with SSL VPN connection attempts in upstream or syslog data.
- Watch for all remote access VPN sessions dropping at the same moment, the typical sign of a forced reload.
What happened#
On October 28, 2026, Cisco published cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418, a flaw in the Remote Access SSL VPN service of Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Cisco attributes it to "logic errors when secondary authentication is configured on a tunnel group." An unauthenticated attacker sends a crafted request while connecting to the VPN, and the firewall reloads. Cisco says: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability."
The CVSS 3.1 score is 8.6 (High), with availability as the only impact (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H). The CVE record describes a device reload, with no code execution or data exposure. Eric Fernald found the bug while resolving a Cisco TAC support case (bug ID CSCwx26625). Neither Cisco nor press coverage names attackers, victims or the scale of the attacks (GBHackers). As of October 29, the CVE was not in CISA's KEV catalog.
This is a different bug from CVE-2026-20349, the ASA and FTD VPN crash flaw exploited in August. Fixing that one does not fix this one. The new fixed builds are later than the September 2026 releases that fixed that bug.
Who is affected#
A device is exposed only when all three conditions hold:
- It runs an affected ASA or FTD release.
- SSL VPN is enabled:
webvpnfollowed byenable <interface_name>for at least one interface. - Secondary authentication (
secondary-authentication-server-group) is set on a tunnel group an attacker can reach. Iftunnel-group-list enableis configured, any tunnel group counts, including DefaultWEBVPNGroup. If it is not, only DefaultWEBVPNGroup matters.
On FTD, review the remote access VPN policy in FMC or FDM and the resulting running configuration. Cisco lists Cloud-delivered Firewall, cloud-delivered FMC, Secure Access and Secure FMC as not vulnerable. Fixed releases:
- ASA: 9.16.4.104 (9.16 and earlier), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1
- FTD: 7.0.11 (7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1
Do you really need to act?#
It depends on one configuration choice. Secondary authentication, where a user logs in against two servers, is common where VPN logins pair a directory with a separate token or RADIUS system, but plenty of deployments do not use it. If yours does not, this bug is not reachable, and you can take the fix with your next scheduled upgrade.
If yours does, the listener is on the internet by design, no login is needed, and Cisco has seen it used. The damage is bounded: a reload drops every VPN session and briefly interrupts traffic through the firewall. Repeated requests can keep a headend down, which matters most during an incident, when remote staff most need access. Cisco describes no device compromise, which is why this rates as a this-week upgrade for exposed devices rather than an emergency. Even so, investigate an unexplained reload instead of just rebooting through it.
What to do now#
- Check exposure:
show running-config webvpn(look forenableandtunnel-group-list enable), thenshow running-config tunnel-group | include tunnel-group|secondary-authentication. Note the release fromshow version. - Upgrade exposed devices to the fixed release for their train. On failover pairs, upgrade the standby unit first, then fail over.
- If an upgrade has to wait and DefaultWEBVPNGroup has no secondary authentication, Cisco's mitigation is
no tunnel-group-list enablein webvpn configuration mode. Users must then know their connection profile name or URL. - If DefaultWEBVPNGroup itself uses secondary authentication, the only mitigation is
no secondary-authentication-server-groupon that group. Cisco warns that this lowers VPN security, so weigh it against the outage risk. - Treat both mitigations as temporary. Cisco says there is no workaround and recommends upgrading.
How to tell if you were hit#
Exploitation shows up as an outage. Compare device uptime in show version against your change records, and check show crashinfo for crash data since early October. Match any reload to SSL VPN connection attempts in syslog or upstream logs around that moment. The typical signature is every remote access session dropping at once. Cisco has published no indicators of compromise. If a crash coincides with odd logins, configuration changes or new local accounts, investigate it as a possible intrusion.
Timeline#
- — CVE-2026-76418 is reserved.
- — Cisco PSIRT learns of active exploitation (exact date not disclosed as of Oct 29, 2026).
- — Cisco publishes the advisory and fixed releases at 19:15 GMT. The CVE record goes live.
Vulnerability records
- CVE-2026-76418 · KEV 2026-10-29 · A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat…
Sources
Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.
Original and primary sources
- Cisco — cisco-sa-asaftd-tunnel-dos-s6mgkb75: ASA and FTD Remote Access SSL VPN tunnel DoS sec.cloudapps.cisco.com
- CVE record — CVE-2026-76418 cve.org
- Cyber Security News — Cisco Secure Firewall 0-day exploited to crash SSL VPN devices cybersecuritynews.com