On this page
Attackers are knocking Cisco firewalls offline by sending one crafted request to the SSL VPN login, and on 29 Oct CISA added the bug, CVE-2026-76418, to its Known Exploited Vulnerabilities catalog. It hits Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) when remote access SSL VPN is on and a tunnel group uses secondary authentication. The attacker does not need to log in. The firewall reloads, every VPN session drops, and nothing stops them from doing it again until you patch.
Short answer: CVE-2026-76418 (CVSS 8.6, CWE-690) is a denial-of-service bug in the Remote Access SSL VPN service of Cisco ASA and FTD. Cisco published fixes on 28 Oct and says it learned of active exploitation in October. CISA's due date for US federal agencies is 1 Nov 2026. Fixed ASA releases are 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1. Fixed FTD releases are 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. It crashes the device. It does not give code execution.
This is our operator read of Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 and the KEV entry. The HOL Guard evidence pack for CVE-2026-76418 is the source record.
How to fix
Upgrade to the first fixed release on your train, or anything later on it:
| Your train | First fixed |
|---|---|
| ASA 9.16 and earlier | 9.16.4.104 |
| ASA 9.18 | 9.18.4.96 |
| ASA 9.20 | 9.20.4.50 |
| ASA 9.22 | 9.22.3.200 |
| ASA 9.23 | 9.23.1.48 |
| ASA 9.24 | 9.24.1.27 or 9.24.10.1 |
| FTD 7.0 and earlier | 7.0.11 |
| FTD 7.2 | 7.2.13 |
| FTD 7.4 | 7.4.9 |
| FTD 7.6 | 7.6.7 |
| FTD 7.7 | 7.7.14 |
| FTD 10.0 | 10.0.3 |
| FTD 10.1 | 10.1.1 |
Some of the ASA fixes are interim builds: 9.18.4.96, for example, sits in Cisco's interim release notes dated 28 Oct. FTD devices upgrade through Secure Firewall Management Center or Device Manager as usual. Before you pick a build, run your version through the Cisco Software Checker linked from the advisory, because it also reports the "combined first fixed" release for every other open ASA and FTD advisory.
Cisco lists no workaround, but it does give a mitigation if you cannot upgrade this week, and it depends on your default tunnel group:
! Case 1: DefaultWEBVPNGroup does NOT use secondary auth
webvpn
no tunnel-group-list enable
! Case 2: DefaultWEBVPNGroup DOES use secondary auth
tunnel-group DefaultWEBVPNGroup general-attributes
no secondary-authentication-server-group
Both cost you something. Case 1 means users have to know their connection profile name, because the drop-down disappears. Case 2 removes a factor from your VPN login, which Cisco itself says lowers your security posture. Turning off the group list does nothing if the default group still uses secondary authentication, and that is the trap in the advisory most people will miss.
Check whether your firewall is exposed
All three must be true for a device to be vulnerable: an affected release, a reachable SSL VPN login, and secondary authentication on a tunnel group in scope. On ASA:
show version | include Version
show running-config webvpn
show running-config webvpn | include tunnel-group-list
show running-config tunnel-group
Read it like this. If webvpn has an enable <interface> line, SSL VPN is on. If tunnel-group-list enable is present, every tunnel group counts, including DefaultWEBVPNGroup, even ones you hide from the login page. If it is absent, only DefaultWEBVPNGroup matters. Any in-scope group with a secondary-authentication-server-group line makes the box exposed.
On FTD, check the remote access VPN policy in Management Center (Devices, VPN, Remote Access) or in Device Manager, then confirm in the deployed running config. Cisco notes a successful VPN login is not needed to reach the bug, so a locked-down user list does not help.
To see whether you have already been hit, look for reloads you did not plan. show version gives uptime, and show crashinfo shows the last crash. A firewall that has rebooted on its own since early October with SSL VPN and secondary auth enabled is worth a TAC case.
Who is not in scope
- Cisco's cloud and management products. Cisco confirms Cloud-delivered Firewall, Cloud-delivered FMC, Secure Access and Secure Firewall Management Center are not affected.
- ASA and FTD without SSL VPN. If no interface has
webvpnSSL VPN enabled, the vulnerable path is not exposed. - SSL VPN without secondary authentication in scope. Profiles that use only primary authentication are not affected, as long as no in-scope tunnel group, including
DefaultWEBVPNGroup, has a secondary authentication server group.
What this is not
This is not remote code execution and not a firewall takeover. Cisco and CISA both describe a NULL pointer dereference that reloads the device, and CISA did not set the forensic triage flag on this entry, unlike today's GitLab addition. Treat it as an availability problem with a long tail: every reload drops your remote workforce, and an attacker who has found your box can keep doing it. It is also the second ASA and FTD VPN crash bug exploited as a zero-day since August, after CVE-2026-20349, according to SecurityWeek and BleepingComputer. Cisco has not said who is behind the attacks or whether the two are linked.
What do people ask about CVE-2026-76418?
What is CVE-2026-76418?
A denial-of-service bug in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD software. An unauthenticated attacker sends a crafted request while connecting to the SSL VPN and the device reloads. It needs secondary authentication on a tunnel group in scope.
Is CVE-2026-76418 exploited?
Yes. Cisco says its PSIRT became aware of active exploitation in October 2026, and CISA added it to the Known Exploited Vulnerabilities catalog on 29 October 2026 with a 1 November 2026 due date. Ransomware use is listed as unknown.
Which ASA and FTD versions fix CVE-2026-76418?
ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1. FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1.
Can CVE-2026-76418 be used to run code on the firewall?
No. Cisco rates the impact as availability only. The device reloads and comes back, and the attacker can repeat it while the device stays unpatched.
References
- Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75
- CISA Known Exploited Vulnerabilities catalog (version 2026.10.29)
- Cisco ASA 9.18.4 interim release notes (9.18.4.96, CSCwx26625)
- SecurityWeek: Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
- BleepingComputer: New Cisco firewall zero-day exploited to crash SSL VPN devices
