Cisco ASA and FTD CVE-2026-76418: exploited SSL VPN crash when secondary authentication is configured

What happened

On 28 October 2026, Cisco published an advisory for CVE-2026-76418 (bug ID CSCwx26625) in the remote access SSL VPN service of Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Logic errors when secondary authentication is configured on a tunnel group let an unauthenticated, remote attacker send a crafted request while connecting to the VPN and make the device reload. The attacker does not need a successful VPN login. Cisco rates it High, CVSS 3.1 8.6 (Cisco).

It is a denial of service only: the CVSS vector has no confidentiality or integrity impact (Cisco). For a VPN headend, a reload drops every remote user and every tunnel through the box.

It is exploited. Cisco says “In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” CISA added it to the KEV catalog on 29 October, with a federal due date of 1 November (CISA KEV). Cisco has not named the attackers or the number of targets (The Hacker News) and has published no indicators of compromise (Cisco).

Eric Fernald found the flaw while resolving a Cisco TAC support case (Cisco).

A separate Cisco flaw, CVE-2026-76519, a path traversal in Secure Email Gateway that lets an unauthenticated attacker write files, has been in KEV since 14 October (CISA KEV). It is a different product and needs its own patch.

Am I affected?

A device is affected only if all three are true (Cisco):

• It runs a vulnerable ASA or FTD release.
• The SSL remote access VPN login service is reachable (webvpn with enable <interface> on at least one interface).
• Secondary authentication (secondary-authentication-server-group) is set in a tunnel group that matters.

Which tunnel groups matter depends on the group list. If tunnel-group-list enable is configured, check every tunnel group, including DefaultWEBVPNGroup and profiles not shown on the login page. If it is absent, check DefaultWEBVPNGroup.

On ASA, from the CLI:

show version | include Software Version
show running-config webvpn
show running-config tunnel-group

On FTD, check Devices > VPN > Remote Access in FMC, or Remote Access VPN in FDM, and review the deployed remote access VPN policy (Cisco).

The CVE record lists affected ASA releases in 9.16, 9.18, 9.19, 9.20, 9.22, 9.23 and 9.24, and FTD in 7.0, 7.2, 7.3, 7.4, 7.6, 7.7, 10.0 and 10.1 (CVE record). Cisco’s fixed-release tables have no row for ASA 9.19 or FTD 7.3, so devices on those releases need to move to a train that has a fix.

Cloud-delivered Firewall, cdFMC, Cisco Secure Access and Secure FMC software are not affected (Cisco).

Signs you were hit: Cisco gives no indicators. Unexpected reloads of a VPN headend since October are the obvious symptom. On ASA, show version gives the uptime and show crashinfo shows the last crash.

What to do now

1. Upgrade to a first fixed release (Cisco):

2. If you cannot upgrade today, remove the trigger. Cisco says no workaround fixes the flaw, but it tested this mitigation in its lab (Cisco). If DefaultWEBVPNGroup does not use secondary authentication, run no tunnel-group-list enable in webvpn configuration mode; users then have to know their connection profile name, because the drop-down list goes away. If DefaultWEBVPNGroup does use secondary authentication, run no secondary-authentication-server-group on it; Cisco warns this lowers your remote access VPN security.
3. Upgrade anyway after mitigating. Cisco says disabling the tunnel group list does not remove exposure if the default group uses secondary authentication, and it strongly recommends the fixed release over the mitigation.

Sources

• Cisco: cisco-sa-asaftd-tunnel-dos-s6mgkb75, ASA and FTD remote access SSL VPN tunnel DoS
• CVE record: CVE-2026-76418
• CISA Known Exploited Vulnerabilities catalog
• The Hacker News: CISA adds actively exploited GitLab RCE and Cisco ASA/FTD flaw to KEV