--- schema: 1 kind: vulnerability title: "CVE-2026-76418, Cisco Secure Firewall ASA and Secure FTD: a crafted request to the remote access SSL VPN reloads the device when a tunnel group uses secondary authentication; Cisco reports active exploitation and CISA lists it (CVSS 3.1 8.6)" headline: "Cisco ASA and FTD SSL VPN reload flaw is exploited and on CISA KEV; fixes in every branch, no workaround" summary: > Cisco's advisory of 2026-10-28 fixes CVE-2026-76418, a logic error in the remote access SSL VPN of Secure Firewall ASA and Secure FTD that lets an unauthenticated attacker reload the device with a crafted connection request when a tunnel group uses secondary authentication, and says Cisco's PSIRT became aware of active exploitation in October 2026; CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-29. Cisco names no actor, offers no workaround and lists first fixed releases for every ASA and FTD branch. discovered_at: "2026-10-30T03:44:00Z" updated_at: null event_date: "2026-10-28" run_id: 2026-10-30T0255Z-intel priority: high immediate_action: null tags: [vulnerabilities, actively-exploited, pre-auth, dos, cisa-kev, patch-available] regions: [global] sectors: [] entities: ["product:cisco-secure-firewall-adaptive-security-appliance-asa", "product:cisco-secure-firewall-threat-defense-ftd"] techniques: [T1190, T1499.004] affected_products: ["Cisco Secure Firewall Adaptive Security Appliance (ASA)", "Cisco Secure Firewall Threat Defense (FTD)"] cves: - id: CVE-2026-76418 cvss: "8.6 (CVSS 3.1)" epss: null type: dos vector: zero-click auth: pre-auth status: [exploited, cisa-kev, patch-available] affected: "ASA and FTD releases below the first fixed release of their branch, with webvpn enabled on an interface and secondary-authentication-server-group set on a tunnel group or on DefaultWEBVPNGroup" fixed: "ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1; FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1" sources: - url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75" publisher: "Cisco PSIRT" date: "2026-10-28" role: primary - url: "https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog" publisher: "CISA" date: "2026-10-29" role: corroborating - url: "https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1412/" publisher: "ANSSI / CERT-FR" date: "2026-10-29" role: corroborating closed_sources: [] evidence: - quote: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." publisher: "Cisco PSIRT" source_url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75" - quote: "This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group." publisher: "Cisco PSIRT" source_url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75" - quote: "A successful VPN login is not required to reach the affected processing path." publisher: "Cisco PSIRT" source_url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75" - quote: "based on evidence of active exploitation" publisher: "CISA" source_url: "https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog" verification: single-source sourcing_note: > Cisco is the disclosing party for its own product and its advisory is the source for the mechanism, the affected configuration, the fixed releases and the exploitation statement. CISA's alert confirms the catalog listing on 2026-10-29 and CERT-FR restates the advisory; neither adds an independent observation of the exploitation, and no source names an actor, a victim or a start date. confidence: high references: ["2026-08-12/cve-2026-20349-cisco-asa-ftd-ssl-vpn-dos-exploited", "2026-10-22/cve-2026-76466-cisco-expressway-cluster-unauth-root-rce"] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Upgrade every Cisco ASA and FTD unit that has webvpn enabled and secondary authentication on any tunnel group, DefaultWEBVPNGroup included, to the first fixed release of its branch (ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 or 9.24.10.1; FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 or 10.1.1), internet-facing units first, because Cisco reports exploitation and its only mitigation removes secondary authentication." updates: [] migrated_from: null --- Cisco's advisory of 2026-10-28 describes CVE-2026-76418, a logic error in the remote access SSL VPN service of Secure Firewall ASA and Secure FTD: an unauthenticated, remote attacker who sends a crafted request while connecting to the SSL VPN makes the device reload, and a successful VPN login is not required to reach the affected processing path ([Cisco PSIRT, 2026-10-28](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75)). Cisco says its PSIRT became aware of active exploitation in October 2026 and names no actor or victim ([Cisco PSIRT, 2026-10-28](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75)); CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-10-29 ([CISA, 2026-10-29](https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog)), and CERT-FR restates the advisory ([ANSSI / CERT-FR, 2026-10-29](https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1412/)). The stated impact is a reload and denial of service, scored CVSS 3.1 8.6 with availability as the only impact; no code execution or data access is described ([Cisco PSIRT, 2026-10-28](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75)). The first fixed releases are ASA 9.16.4.104 (for 9.16 and earlier), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1, and FTD 7.0.11 (for 7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1 ([Cisco PSIRT, 2026-10-28](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75)). Cisco lists no workaround; its mitigation is to remove secondary authentication from the tunnel group, which lowers the security posture of the remote access VPN, or, where DefaultWEBVPNGroup does not use secondary authentication, to disable the tunnel group list with `no tunnel-group-list enable` ([Cisco PSIRT, 2026-10-28](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75)). Cisco confirms that Secure FMC, Cloud-delivered Firewall, cdFMC and Secure Access are not affected ([Cisco PSIRT, 2026-10-28](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75)). **Exposure:** an ASA or FTD unit below the first fixed release of its branch whose running configuration has `webvpn` enabled on an interface and `secondary-authentication-server-group` on any tunnel group; the default tunnel group DefaultWEBVPNGroup counts even when the tunnel group list is disabled. On FTD, read the deployed remote access VPN policy and the resulting configuration in FMC or FDM (Devices > VPN > Remote Access) ([Cisco PSIRT, 2026-10-28](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75)). **Detection:** neither Cisco nor CISA publishes an indicator. The mechanism points at device availability telemetry: unexpected reloads, HA failover flaps, uptime resets and crash files on units that terminate the remote access VPN, read against VPN authentication logs for connection attempts from external addresses that never complete a login. **Triage:** a reload also follows upgrades, HA events and hardware faults; a reload that coincides with unauthenticated SSL VPN connection attempts from an external address is the pattern the stated mechanism produces. **Defender takeaway:** upgrade the units that terminate remote access SSL VPN with secondary authentication this week, perimeter units first; Cisco states denial of service as the only impact, so patching leaves no further step, and removing secondary authentication as a stop-gap trades an outage risk for a weaker VPN login.