Cisco has patched a flaw in the remote access SSL VPN service of its Secure Firewall ASA and FTD
software, CVE-2026-76418, that attackers are already using to crash firewalls. An unauthenticated
attacker on the network can send a crafted request during SSL VPN connection and force the device to
reload, knocking remote access offline. The flaw is reachable when the device runs SSL VPN and uses
secondary authentication on a tunnel group, and a successful login is not needed to trigger it. There is
no workaround that fixes the issue, only a mitigation that weakens the setup, so upgrading to the fixed
release is the real fix. More than 51,000 Cisco ASA SSL VPN devices are exposed online.
1. Vulnerability Details
CVE ID- CVE-2026-76418
CVSS SCORE- 8.6
EXPLOIT STATUS- Active exploitation confirmed by Cisco PSIRT in October 2026; exploited as a zero-day. Impact
is denial of service, not code execution.
The flaw is due to logic errors when secondary authentication is configured on a tunnel group in the remote access SSL
VPN service of Cisco Secure Firewall ASA and FTD software (CWE-690, improper handling of a null or unexpected value
path). An unauthenticated, remote attacker who sends a crafted request when connecting to the SSL remote access VPN
can make the device reload, causing a denial of service. A device is affected when the running configuration contains the
webvpn keyword with SSL VPN enabled on at least one interface, and a tunnel group, including the default
DefaultWEBVPNGroup, uses secondary-authentication-server-group. A successful VPN login is not required to reach the
affected processing path. Cloud-delivered Firewall, cdFMC, Secure Access and Secure FMC Software are not affected.
2. Affected Products & Fixed Versions
| Component | Vulnerable Versions | Fixed Build |
| Cisco Secure Firewall ASA 9.16 and earlier | Below first fixed | 9.16.4.104 |
| Cisco Secure Firewall ASA 9.18 | Below first fixed | 9.18.4.96 |
| Cisco Secure Firewall ASA 9.20 | Below first fixed | 9.20.4.50 |
| Cisco Secure Firewall ASA 9.22 | Below first fixed | 9.22.3.200 |
| Cisco Secure Firewall ASA 9.23 | Below first fixed | 9.23.1.48 |
| Cisco Secure Firewall ASA 9.24 | Below first fixed | 9.24.1.27 or 9.24.10.1 |
| Cisco Secure FTD 7.0 and earlier | Below first fixed | 7.0.11 |
| Cisco Secure FTD 7.2 | Below first fixed | 7.2.13 |
| Cisco Secure FTD 7.4 | Below first fixed | 7.4.9 |
| Cisco Secure FTD 7.6 | Below first fixed | 7.6.7 |
| Cisco Secure FTD 7.7 | Below first fixed | 7.7.14 |
| Cisco Secure FTD 10.0 | Below first fixed | 10.0.3 |
| Cisco Secure FTD 10.1 | Below first fixed | 10.1.1 |
3. Observed Activity
- Active zero-day exploitation Cisco PSIRT became aware of active exploitation of this vulnerability in October 2026 and published the advisory on 28 October. Cisco shared no indicators of compromise and no detail on who is exploiting it or which organisations are targeted. The flaw was found by Eric Fernald during a Cisco TAC support case.
- Large exposed surface Shadowserver tracks more than 51,000 internet-exposed Cisco ASA SSL VPN devices, though it does not say how many are already patched or are honeypots. Cisco ASA and FTD remote access devices have been repeatedly targeted, including the ArcaneDoor campaign and the CVE-2026-20349 DoS zero-day earlier in 2026
4. Recommendations
- Upgrade Cisco Secure Firewall ASA and FTD devices to the fixed release for your branch (see the table above); there is no workaround that fixes this flaw, only mitigations, and exploitation is already under way.
- Determine exposure first: check the running configuration for the webvpn keyword with SSL VPN enabled on an interface, and check all tunnel groups, including DefaultWEBVPNGroup, for secondary-authentication server-group, remembering that a successful login is not needed to reach the flaw.
- If you cannot patch at once, apply Cisco’s mitigation: where DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel group list with no tunnel-group-list enable; where it does, remove it with no secondary-authentication-server-group, accepting the usability and security-posture trade-offs.
- Restrict SSL VPN reachability to the extent your remote-access model allows, prioritise internet-facing ASA and FTD devices given active exploitation, and monitor for unexpected device reloads or crashes as a possible sign of exploitation.
5. Sources
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75
- https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-t
o-crash-ssl-vpn-devices/ - https://nvd.nist.gov/vuln/detail/cve-2026-76418
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.