--- title: "Cisco ASA/FTD CVE-2026-76418: Exploited VPN Crash Bug" url: https://erroneo.us/security/briefs/cisco-asa-ftd-ssl-vpn-secondary-auth-dos-cve-2026-76418/ description: "Unauthenticated reload of Cisco ASA and FTD SSL VPN when secondary authentication is set. Exploited in October. Fixed in new ASA/FTD builds; check your config." type: security-brief section: "Security Digest" date_published: 2026-10-28 date_modified: 2026-10-28 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Check exposure" cves: ["CVE-2026-76418"] severity: "high" exploited: "in-the-wild" kev: true license: All rights reserved. Quote with attribution and a link. --- # Cisco ASA/FTD CVE-2026-76418: Exploited VPN Crash Bug **Verdict: Check exposure.** Only ASA and FTD headends that offer SSL remote access VPN with secondary authentication can be crashed, but that is being done in the wild, so those devices should be upgraded this week. - **Who must act:** Teams whose Cisco ASA or FTD terminates SSL remote access VPN and has secondary-authentication-server-group set on a reachable tunnel group, including DefaultWEBVPNGroup. - **Who can relax:** Firewalls without SSL VPN enabled, VPN headends that use only a single authentication server, and Cisco's cloud-delivered firewall, cdFMC, Secure Access and Secure FMC, which Cisco lists as not vulnerable. - **Affected:** Cisco ASA 9.16 and earlier before 9.16.4.104; Cisco ASA 9.18 before 9.18.4.96; Cisco ASA 9.20 before 9.20.4.50; Cisco ASA 9.22 before 9.22.3.200; Cisco ASA 9.23 before 9.23.1.48; Cisco ASA 9.24 before 9.24.1.27; Cisco FTD 7.0 and earlier before 7.0.11; Cisco FTD 7.2 before 7.2.13; Cisco FTD 7.4 before 7.4.9; Cisco FTD 7.6 before 7.6.7; Cisco FTD 7.7 before 7.7.14; Cisco FTD 10.0 before 10.0.3; Cisco FTD 10.1 before 10.1.1 - **Fixed:** ASA 9.16.4.104; ASA 9.18.4.96; ASA 9.20.4.50; ASA 9.22.3.200; ASA 9.23.1.48; ASA 9.24.1.27 or 9.24.10.1; FTD 7.0.11; FTD 7.2.13; FTD 7.4.9; FTD 7.6.7; FTD 7.7.14; FTD 10.0.3; FTD 10.1.1 - **CVEs:** CVE-2026-76418 - **CISA KEV:** yes · **Exploitation:** Exploited in the wild ## What to do 1. On each ASA and FTD, check for webvpn with an enabled interface and for secondary-authentication-server-group on any reachable tunnel group. 2. Upgrade exposed devices to the first fixed release for their train, internet-facing VPN headends first. 3. If you cannot upgrade yet and DefaultWEBVPNGroup has no secondary authentication, disable the tunnel group list with no tunnel-group-list enable. 4. Remove secondary authentication only as a last resort and only after weighing the security loss, since it weakens VPN login. 5. Alert on unexpected firewall reloads so a crash is investigated rather than just rebooted through. ### How to check if you are affected - Compare uptime in show version against your change log and check show crashinfo for unexplained reloads since early October. - Correlate reload times with SSL VPN connection attempts in upstream or syslog data. - Watch for all remote access VPN sessions dropping at the same moment, the typical sign of a forced reload. ## What happened On October 28, 2026, Cisco published [cisco-sa-asaftd-tunnel-dos-s6mgkb75](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75) for CVE-2026-76418, a flaw in the Remote Access SSL VPN service of Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Cisco attributes it to "logic errors when secondary authentication is configured on a tunnel group." An unauthenticated attacker sends a crafted request while connecting to the VPN, and the firewall reloads. Cisco says: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." The CVSS 3.1 score is 8.6 (High), with availability as the only impact (`AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H`). The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-76418) describes a device reload, with no code execution or data exposure. Eric Fernald found the bug while resolving a Cisco TAC support case (bug ID CSCwx26625). Neither Cisco nor press coverage names attackers, victims or the scale of the attacks ([GBHackers](https://gbhackers.com/cisco-patches-actively-exploited-ssl-vpn-vulnerability/)). As of October 29, the CVE was not in CISA's KEV catalog. This is a different bug from CVE-2026-20349, the ASA and FTD VPN crash flaw exploited in August. Fixing that one does not fix this one. The new fixed builds are later than the September 2026 releases that fixed that bug. ## Who is affected A device is exposed only when all three conditions hold: - It runs an affected ASA or FTD release. - SSL VPN is enabled: `webvpn` followed by `enable ` for at least one interface. - Secondary authentication (`secondary-authentication-server-group`) is set on a tunnel group an attacker can reach. If `tunnel-group-list enable` is configured, any tunnel group counts, including DefaultWEBVPNGroup. If it is not, only DefaultWEBVPNGroup matters. On FTD, review the remote access VPN policy in FMC or FDM and the resulting running configuration. Cisco lists Cloud-delivered Firewall, cloud-delivered FMC, Secure Access and Secure FMC as not vulnerable. Fixed releases: - **ASA:** 9.16.4.104 (9.16 and earlier), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1 - **FTD:** 7.0.11 (7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1 ## Do you really need to act? It depends on one configuration choice. Secondary authentication, where a user logs in against two servers, is common where VPN logins pair a directory with a separate token or RADIUS system, but plenty of deployments do not use it. If yours does not, this bug is not reachable, and you can take the fix with your next scheduled upgrade. If yours does, the listener is on the internet by design, no login is needed, and Cisco has seen it used. The damage is bounded: a reload drops every VPN session and briefly interrupts traffic through the firewall. Repeated requests can keep a headend down, which matters most during an incident, when remote staff most need access. Cisco describes no device compromise, which is why this rates as a this-week upgrade for exposed devices rather than an emergency. Even so, investigate an unexplained reload instead of just rebooting through it. ## What to do now 1. Check exposure: `show running-config webvpn` (look for `enable` and `tunnel-group-list enable`), then `show running-config tunnel-group | include tunnel-group|secondary-authentication`. Note the release from `show version`. 2. Upgrade exposed devices to the fixed release for their train. On failover pairs, upgrade the standby unit first, then fail over. 3. If an upgrade has to wait and DefaultWEBVPNGroup has no secondary authentication, Cisco's mitigation is `no tunnel-group-list enable` in webvpn configuration mode. Users must then know their connection profile name or URL. 4. If DefaultWEBVPNGroup itself uses secondary authentication, the only mitigation is `no secondary-authentication-server-group` on that group. Cisco warns that this lowers VPN security, so weigh it against the outage risk. 5. Treat both mitigations as temporary. Cisco says there is no workaround and recommends upgrading. ## How to tell if you were hit Exploitation shows up as an outage. Compare device uptime in `show version` against your change records, and check `show crashinfo` for crash data since early October. Match any reload to SSL VPN connection attempts in syslog or upstream logs around that moment. The typical signature is every remote access session dropping at once. Cisco has published no indicators of compromise. If a crash coincides with odd logins, configuration changes or new local accounts, investigate it as a possible intrusion. ## Timeline - Aug 19, 2026 — CVE-2026-76418 is reserved. - Oct 2026 — Cisco PSIRT learns of active exploitation (exact date not disclosed as of Oct 29, 2026). - Oct 28, 2026 — Cisco publishes the advisory and fixed releases at 19:15 GMT. The CVE record goes live. ## Sources 1. [Cisco — cisco-sa-asaftd-tunnel-dos-s6mgkb75: ASA and FTD Remote Access SSL VPN tunnel DoS](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75) 2. [CVE record — CVE-2026-76418](https://www.cve.org/CVERecord?id=CVE-2026-76418) 3. [Cyber Security News — Cisco Secure Firewall 0-day exploited to crash SSL VPN devices](https://cybersecuritynews.com/cisco-secure-firewall-0-day-vulnerability-exploited/) 4. [GBHackers — Cisco patches actively exploited SSL VPN vulnerability affecting ASA and FTD](https://gbhackers.com/cisco-patches-actively-exploited-ssl-vpn-vulnerability/) --- Source page: https://erroneo.us/security/briefs/cisco-asa-ftd-ssl-vpn-secondary-auth-dos-cve-2026-76418/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt