One unauthenticated SSL VPN request reloads ASA or FTD when a tunnel group uses secondary authentication. Exploited, on KEV, with fixes per train.
Cisco has patched CVE-2026-76418, a high-severity flaw in Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software that lets an unauthenticated attacker crash the device through its remote access SSL VPN. Cisco says its PSIRT learned of active exploitation in October 2026. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 29 October, with a remediation due date of 1 November. Cisco did not name an actor or campaign, and CISA lists ransomware use as unknown.
What the flaw does
Cisco rates the bug CVSS 3.1 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H). A remote attacker with no credentials sends a crafted request while connecting to the SSL VPN, and the device reloads. The advisory attributes this to logic errors when secondary authentication is configured on a tunnel group. It is tracked as CWE-690, an unchecked return value leading to a NULL pointer dereference (CISA's catalog name), under Cisco bug ID CSCwx26625. A successful VPN login is not needed to reach the vulnerable code path. Impact is availability only: no confidentiality or integrity impact is scored, but a repeatable reload of an internet-facing firewall takes remote access down for every user behind it.
The device reloads from one crafted request only when all four exposure conditions hold at once.
Who is exposed
A device is vulnerable only if all of these hold:
- It runs a vulnerable ASA or FTD release.
- The configuration has
webvpnenabled on at least one interface (enable <interface_name>). - The SSL VPN login service is reachable.
- A tunnel group has secondary authentication configured.
Cloud-delivered Firewall, cdFMC, Secure Access and Secure FMC Software are not affected.
How to check your configuration
- If
tunnel-group-list enableis configured, inspect every tunnel group, including DefaultWEBVPNGroup, forsecondary-authentication-server-group. This includes profiles that are not shown on the login page. - If
tunnel-group-list enableis absent or was removed, still check DefaultWEBVPNGroup. - On FTD, review the deployed remote access VPN policy in FMC (Devices > VPN > Remote Access) or in FDM, and compare it with the running configuration.
Cisco's Software Checker can confirm whether a specific release is exposed.
Fixed releases
Cisco's fixed-software table lists the first fixed release per train.
| ASA train | First fixed |
|---|---|
| 9.16 and earlier | 9.16.4.104 |
| 9.18 | 9.18.4.96 |
| 9.20 | 9.20.4.50 |
| 9.22 | 9.22.3.200 |
| 9.23 | 9.23.1.48 |
| 9.24 | 9.24.1.27 and 9.24.10.1 |
| FTD train | First fixed |
|---|---|
| 7.0 and earlier | 7.0.11 |
| 7.2 | 7.2.13 |
| 7.4 | 7.4.9 |
| 7.6 | 7.6.7 |
| 7.7 | 7.7.14 |
| 10.0 | 10.0.3 |
| 10.1 | 10.1.1 |
What defenders should do
- Upgrade to the fixed release for your train. Cisco strongly recommends this over any mitigation.
- If you cannot patch at once, Cisco offers two mitigations that lower the security posture. If DefaultWEBVPNGroup does not use secondary authentication, run
no tunnel-group-list enable; users must then know the exact connection profile name. If DefaultWEBVPNGroup does use it, runno secondary-authentication-server-groupthere. Cisco states that no workaround fully addresses the flaw. - Look for unexpected firewall reloads and crashes since October, and for bursts of unauthenticated connections to the SSL VPN login endpoint.
- Federal civilian agencies were given until 1 November through the KEV catalog; other organisations should treat that date as a guide.
The flaw was found by Eric Fernald while resolving a Cisco TAC support case. A secondary report says no public proof-of-concept code has been released.