CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Cisco Secure Firewall ASA and Secure FTD remote access SSL VPN reload (denial of service) when a tunnel group uses secondary authentication (CVSS 3.1 8.6): exploited per Cisco and listed in CISA KEV on 2026-10-29; fixed in every ASA and FTD branch, no workaround

cve · CVE-2026-76418 single-source

Coverage
1
first 2026-10-30 → last 2026-10-30
Latest activity
2026-10-30
Cisco ASA and FTD SSL VPN reload flaw is exploited and on CISA KEV; fixes in every branch, no workaround
Peak priority
high
1 high
Targets
·
no sector or region stated
Sources cited
3
3 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-76418, newest first. Check the date before acting on an older one.

  • Upgrade every Cisco ASA and FTD unit that has webvpn enabled and secondary authentication on any tunnel group, DefaultWEBVPNGroup included, to the first fixed release of its branch (ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 or 9.24.10.1; FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 or 10.1.1), internet-facing units first, because Cisco reports exploitation and its only mitigation removes secondary authentication.
    2026-10-30CVE-2026-76418

Defender insights

What each entry about CVE-2026-76418 tells a defender to do, newest first.

2026-10-30HIGHexploitedCisco ASA and FTD SSL VPN reload flaw is exploited and on CISA KEV; fixes in every branch, no workaround

Exposure · triage · detection

Story timeline

  1. 2026-10-30CVE-2026-76418, Cisco Secure Firewall ASA and Secure FTD: a crafted request to the remote access SSL VPN reloads the device when a tunnel group uses secondary authentication; Cisco reports active exploitation and CISA lists it (CVSS 3.1 8.6)
    trending-vulnerabilitiesCisco ASA and FTD SSL VPN reload flaw is exploited and on CISA KEV; fixes in every branch, no workaround

Hunting pivots

Affected products
Cisco Secure Firewall Adaptive Security Appliance (ASA)Cisco Secure Firewall Threat Defense (FTD)
Tags
actively-exploitedcisa-kevdospatch-availablepre-authvulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ImpactEndpoint Denial of Service: Application or System Exploitation

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-30/cve-2026-76418-cisco-asa-ftd-ssl-vpn-reload-exploited · ATT&CK page ↗

Impact TA0040

T1499.004Endpoint Denial of Service: Application or System Exploitation×1

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.

Evidence: 2026-10-30/cve-2026-76418-cisco-asa-ftd-ssl-vpn-reload-exploited · ATT&CK page ↗

Entries about Cisco Secure Firewall ASA and Secure FTD remote access SSL VPN reload (denial of service) when a tunnel group uses secondary authentication (CVSS 3.1 8.6): exploited per Cisco and listed in CISA KEV on 2026-10-29; fixed in every ASA and FTD branch, no workaround (1)

2026-10-30 · view entry permalink →

HIGHCVE-2026-76418exploitedNATOA2

CVE-2026-76418, Cisco Secure Firewall ASA and Secure FTD: a crafted request to the remote access SSL VPN reloads the device when a tunnel group uses secondary authentication; Cisco reports active exploitation and CISA lists it (CVSS 3.1 8.6)

Cisco's advisory of 2026-10-28 describes CVE-2026-76418, a logic error in the remote access SSL VPN service of Secure Firewall ASA and Secure FTD: an unauthenticated, remote attacker who sends a crafted request while connecting to the SSL VPN makes the device reload, and a successful VPN login is not required to reach the affected processing path (Cisco PSIRT, 2026-10-28). Cisco says its PSIRT became aware of active exploitation in October 2026 and names no actor or victim (Cisco PSIRT, 2026-10-28); CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-10-29 (CISA, 2026-10-29), and CERT-FR restates the advisory (ANSSI / CERT-FR, 2026-10-29). The stated impact is a reload and denial of service, scored CVSS 3.1 8.6 with availability as the only impact; no code execution or data access is described (Cisco PSIRT, 2026-10-28).

The first fixed releases are ASA 9.16.4.104 (for 9.16 and earlier), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1, and FTD 7.0.11 (for 7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1 (Cisco PSIRT, 2026-10-28). Cisco lists no workaround; its mitigation is to remove secondary authentication from the tunnel group, which lowers the security posture of the remote access VPN, or, where DefaultWEBVPNGroup does not use secondary authentication, to disable the tunnel group list with no tunnel-group-list enable (Cisco PSIRT, 2026-10-28). Cisco confirms that Secure FMC, Cloud-delivered Firewall, cdFMC and Secure Access are not affected (Cisco PSIRT, 2026-10-28).

Triage: a reload also follows upgrades, HA events and hardware faults; a reload that coincides with unauthenticated SSL VPN connection attempts from an external address is the pattern the stated mechanism produces.

In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.

This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group.

A successful VPN login is not required to reach the affected processing path.

Cisco PSIRT 2026-10-28

based on evidence of active exploitation

CISA 2026-10-29

Builds on: Cisco confirms exploitation of an unauthenticated ASA/FTD VPN denial-of-service flaw; hardening… · Cisco: unauthenticated root RCE on clustered Expressway, fixed only in X15.5.20; X14 and…

vulnerability30 Oct 03:44Zsingle-sourceOpen finding →
Sources: Cisco PSIRT · CISA · ANSSI / CERT-FR

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cert.cyber.gouv.fr1 (33%)
  • cisa.gov1 (33%)
  • sec.cloudapps.cisco.com1 (33%)

External references

NVD · cve.org · CISA KEV

All cited sources (3)