high severityConfidence highHistorical record

Cisco ASA and FTD SSL VPN crash bug exploited as a zero-day: unauthenticated reloads via secondary authentication (CVE-2026-76418, CISA KEV)

Direct answer

Cisco ASA and FTD SSL VPN crash bug exploited as a zero-day: unauthenticated reloads via secondary authentication (CVE-2026-76418, CISA KEV), also tracked as CVE-2026-76418 / cisco-sa-asaftd-tunnel-dos-s6mgkb75 / CSCwx26625 is a high-severity threat campaign HOL Guard tracked from Oct 1, 2026 to Oct 29, 2026, verified against 6 primary sources and last reviewed Oct 29, 2026. Active tracking has ended and the record remains published as a permanent historical research record.

On 2026-10-28 Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418 (CVSS 8.6, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, CWE-690), a denial-of-service bug in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Logic errors when secondary authentication is configured on a tunnel group let an unauthenticated remote attacker send a crafted request while connecting to the SSL VPN and make the device reload; a successful VPN login is not required. A device is vulnerable only if it runs an affected release, the SSL VPN login service is reachable (webvpn enabled on an interface), and secondary-authentication-server-group is set on an in-scope tunnel group: every tunnel group including DefaultWEBVPNGroup when tunnel-group-list enable is configured, otherwise DefaultWEBVPNGroup. Cisco PSIRT became aware of active exploitation in October 2026. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-10-29 (version 2026.10.29) with a 2026-11-01 due date; forensic triage is not required and ransomware use is unknown. SecurityWeek and BleepingComputer report it is the second ASA/FTD VPN denial-of-service zero-day since August, after CVE-2026-20349.

Also tracked as CVE-2026-76418 · cisco-sa-asaftd-tunnel-dos-s6mgkb75 · CSCwx26625 · Cisco Secure Firewall ASA and FTD Remote Access SSL VPN Tunnel Denial of Service Vulnerability · Cisco ASA FTD SSL VPN zero-day October 2026 · Cisco firewall VPN reload exploit

First observed
Oct 1, 2026
Last observed
Oct 29, 2026
Last reviewed
Oct 29, 2026
Tracking ended
Oct 29, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

Cisco has not published indicators of compromise, attacker identity or the number of affected customers, and CISA does not publish the evidence behind KEV entries. It is not known whether the attacks are linked to the August CVE-2026-20349 exploitation. Exposure counts such as Shadowserver's reported 51,000 internet-facing ASA SSL VPN devices do not distinguish devices with secondary authentication.

  • Cisco confirms Cloud-delivered Firewall, Cloud-delivered FMC, Secure Access and Secure Firewall Management Center are not affected
  • ASA and FTD devices without SSL VPN enabled on any interface are not exposed
  • Tunnel groups that use only primary authentication are not affected, provided no in-scope tunnel group including DefaultWEBVPNGroup has a secondary authentication server group
  • The impact is a device reload (availability); Cisco does not describe code execution or data exposure

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Not covered, or partially covered

  • not covered

    HOL Guard reviews AI coding agent actions on developer machines. It does not inspect or patch Cisco firewalls; the fix is upgrading ASA or FTD to a fixed release.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. First observed

    Cisco PSIRT becomes aware of active exploitation of the Remote Access SSL VPN reload bug during October 2026 (exact date not published).

    Source:Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75

  2. Vendor action

    Cisco publishes cisco-sa-asaftd-tunnel-dos-s6mgkb75 with fixed ASA and FTD releases, a mitigation and no workaround.

    Sources:Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75·Cisco ASA 9.18.4 interim release notes (9.18.4.96 fixes CSCwx26625)

  3. Update

    SecurityWeek and BleepingComputer report the second ASA/FTD VPN denial-of-service zero-day since August.

    Sources:SecurityWeek: Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August·BleepingComputer: New Cisco firewall zero-day exploited to crash SSL VPN devices

  4. Update

    CISA adds CVE-2026-76418 to the KEV catalog (version 2026.10.29), due 2026-11-01, forensic triage not required, ransomware use unknown.

    Source:CISA Known Exploited Vulnerabilities catalog feed (version 2026.10.29)

  5. Update

    HOL publishes operator guidance with the fixed-release table, exposure check commands and mitigation trade-offs.

    Source:HOL Guard operator write-up: Cisco ASA and FTD CVE-2026-76418 on CISA KEV

Publication clock: 0.1 hours from reviewed disclosure timestamp to HOL publication; 24-hour high target; within target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • Cisco Secure Firewall ASA Software@fixed in 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, 9.24.10.1ciscopackage
  • Cisco Secure Firewall Threat Defense (FTD) Software@fixed in 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1ciscopackage

Sources

Every claim on this record is traceable to the sources below.

Campaign questions, answered

On 2026-10-28 Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418 (CVSS 6, HOL Guard tracked the campaign from Oct 1, 2026 to Oct 29, 2026.

No. Active tracking ended Oct 29, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.

The record cites 6 primary sources, names 2 reviewed artifacts, and was last fully reviewed Oct 29, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.

Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. Cisco has not published indicators of compromise, attacker identity or the number of affected customers, and CISA does not publish the evidence behind KEV entries.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-3A9E8615