CVE-2026-76418, Cisco Secure Firewall ASA and Secure FTD: a crafted request to the remote access SSL VPN reloads the device when a tunnel group uses secondary authentication; Cisco reports active exploitation and CISA lists it (CVSS 3.1 8.6)
Cisco ASA and FTD SSL VPN reload flaw is exploited and on CISA KEV; fixes in every branch, no workaround
Defender actions
- Upgrade every Cisco ASA and FTD unit that has webvpn enabled and secondary authentication on any tunnel group, DefaultWEBVPNGroup included, to the first fixed release of its branch (ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 or 9.24.10.1; FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 or 10.1.1), internet-facing units first, because Cisco reports exploitation and its only mitigation removes secondary authentication.
Analysis
Cisco's advisory of 2026-10-28 describes CVE-2026-76418, a logic error in the remote access SSL VPN service of Secure Firewall ASA and Secure FTD: an unauthenticated, remote attacker who sends a crafted request while connecting to the SSL VPN makes the device reload, and a successful VPN login is not required to reach the affected processing path (Cisco PSIRT, 2026-10-28). Cisco says its PSIRT became aware of active exploitation in October 2026 and names no actor or victim (Cisco PSIRT, 2026-10-28); CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-10-29 (CISA, 2026-10-29), and CERT-FR restates the advisory (ANSSI / CERT-FR, 2026-10-29). The stated impact is a reload and denial of service, scored CVSS 3.1 8.6 with availability as the only impact; no code execution or data access is described (Cisco PSIRT, 2026-10-28).
The first fixed releases are ASA 9.16.4.104 (for 9.16 and earlier), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1, and FTD 7.0.11 (for 7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1 (Cisco PSIRT, 2026-10-28). Cisco lists no workaround; its mitigation is to remove secondary authentication from the tunnel group, which lowers the security posture of the remote access VPN, or, where DefaultWEBVPNGroup does not use secondary authentication, to disable the tunnel group list with no tunnel-group-list enable (Cisco PSIRT, 2026-10-28). Cisco confirms that Secure FMC, Cloud-delivered Firewall, cdFMC and Secure Access are not affected (Cisco PSIRT, 2026-10-28).
Triage: a reload also follows upgrades, HA events and hardware faults; a reload that coincides with unauthenticated SSL VPN connection attempts from an external address is the pattern the stated mechanism produces.
Cited evidence
In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.
This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group.
A successful VPN login is not required to reach the affected processing path.
based on evidence of active exploitation
Sources3
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.