{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-3A9E8615",
  "slug": "cve-2026-76418-cisco-asa-ftd-ssl-vpn-dos-cisa-kev",
  "title": "Cisco ASA and FTD SSL VPN crash bug exploited as a zero-day: unauthenticated reloads via secondary authentication (CVE-2026-76418, CISA KEV)",
  "aliases": [
    "CVE-2026-76418",
    "cisco-sa-asaftd-tunnel-dos-s6mgkb75",
    "CSCwx26625",
    "Cisco Secure Firewall ASA and FTD Remote Access SSL VPN Tunnel Denial of Service Vulnerability",
    "Cisco ASA FTD SSL VPN zero-day October 2026",
    "Cisco firewall VPN reload exploit"
  ],
  "summary": "On 2026-10-28 Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418 (CVSS 8.6, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, CWE-690), a denial-of-service bug in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Logic errors when secondary authentication is configured on a tunnel group let an unauthenticated remote attacker send a crafted request while connecting to the SSL VPN and make the device reload; a successful VPN login is not required. A device is vulnerable only if it runs an affected release, the SSL VPN login service is reachable (webvpn enabled on an interface), and secondary-authentication-server-group is set on an in-scope tunnel group: every tunnel group including DefaultWEBVPNGroup when tunnel-group-list enable is configured, otherwise DefaultWEBVPNGroup. Cisco PSIRT became aware of active exploitation in October 2026. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-10-29 (version 2026.10.29) with a 2026-11-01 due date; forensic triage is not required and ransomware use is unknown. SecurityWeek and BleepingComputer report it is the second ASA/FTD VPN denial-of-service zero-day since August, after CVE-2026-20349.",
  "status": "published",
  "severity": "high",
  "confidence": "high",
  "uncertainty": "Cisco has not published indicators of compromise, attacker identity or the number of affected customers, and CISA does not publish the evidence behind KEV entries. It is not known whether the attacks are linked to the August CVE-2026-20349 exploitation. Exposure counts such as Shadowserver's reported 51,000 internet-facing ASA SSL VPN devices do not distinguish devices with secondary authentication.",
  "firstObservedAt": "2026-10-01T00:00:00Z",
  "lastObservedAt": "2026-10-29T19:52:32Z",
  "publishedAt": "2026-10-29T19:59:03.378Z",
  "reviewedAt": "2026-10-29T19:58:58.586Z",
  "expiresAt": "2026-10-29T19:52:32Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "cisco-advisory",
      "label": "Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-28T19:15:00Z"
    },
    {
      "id": "cisa-kev",
      "label": "CISA Known Exploited Vulnerabilities catalog feed (version 2026.10.29)",
      "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "sourceType": "government",
      "observedAt": "2026-10-29T19:09:34Z"
    },
    {
      "id": "cisco-asa-interim",
      "label": "Cisco ASA 9.18.4 interim release notes (9.18.4.96 fixes CSCwx26625)",
      "url": "https://www.cisco.com/web/software/280775065/166425/ASA-9184-Interim-Release-Notes.html",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-28T00:00:00Z"
    },
    {
      "id": "securityweek",
      "label": "SecurityWeek: Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August",
      "url": "https://www.securityweek.com/attackers-exploit-second-cisco-firewall-vpn-zero-day-since-august/",
      "sourceType": "research",
      "observedAt": "2026-10-29T09:47:00Z"
    },
    {
      "id": "bleepingcomputer",
      "label": "BleepingComputer: New Cisco firewall zero-day exploited to crash SSL VPN devices",
      "url": "https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/",
      "sourceType": "research",
      "observedAt": "2026-10-29T11:10:00Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL Guard operator write-up: Cisco ASA and FTD CVE-2026-76418 on CISA KEV",
      "url": "https://hol.org/blog/cve-2026-76418-cisco-asa-ftd-ssl-vpn-dos-cisa-kev",
      "sourceType": "other_primary",
      "observedAt": "2026-10-29T19:52:32Z"
    }
  ],
  "artifacts": [
    {
      "id": "cisco-asa",
      "artifactClass": "package",
      "ecosystem": "cisco",
      "name": "Cisco Secure Firewall ASA Software",
      "version": "fixed in 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, 9.24.10.1",
      "defanged": false
    },
    {
      "id": "cisco-ftd",
      "artifactClass": "package",
      "ecosystem": "cisco",
      "name": "Cisco Secure Firewall Threat Defense (FTD) Software",
      "version": "fixed in 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "exploitation-observed",
      "occurredAt": "2026-10-01T00:00:00Z",
      "eventType": "first_observed",
      "summary": "Cisco PSIRT becomes aware of active exploitation of the Remote Access SSL VPN reload bug during October 2026 (exact date not published).",
      "sourceIds": [
        "cisco-advisory"
      ]
    },
    {
      "id": "cisco-advisory-published",
      "occurredAt": "2026-10-28T19:15:00Z",
      "eventType": "vendor_action",
      "summary": "Cisco publishes cisco-sa-asaftd-tunnel-dos-s6mgkb75 with fixed ASA and FTD releases, a mitigation and no workaround.",
      "sourceIds": [
        "cisco-advisory",
        "cisco-asa-interim"
      ]
    },
    {
      "id": "press-coverage",
      "occurredAt": "2026-10-29T09:47:00Z",
      "eventType": "other",
      "summary": "SecurityWeek and BleepingComputer report the second ASA/FTD VPN denial-of-service zero-day since August.",
      "sourceIds": [
        "securityweek",
        "bleepingcomputer"
      ]
    },
    {
      "id": "cisa-kev-add",
      "occurredAt": "2026-10-29T19:09:34Z",
      "eventType": "other",
      "summary": "CISA adds CVE-2026-76418 to the KEV catalog (version 2026.10.29), due 2026-11-01, forensic triage not required, ransomware use unknown.",
      "sourceIds": [
        "cisa-kev"
      ]
    },
    {
      "id": "hol-blog-published",
      "occurredAt": "2026-10-29T19:52:32Z",
      "eventType": "other",
      "summary": "HOL publishes operator guidance with the fixed-release table, exposure check commands and mitigation trade-offs.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [
    {
      "assertionId": "guard-not-firewall",
      "relationship": "not_covered",
      "limitation": "HOL Guard reviews AI coding agent actions on developer machines. It does not inspect or patch Cisco firewalls; the fix is upgrading ASA or FTD to a fixed release."
    }
  ],
  "policies": [],
  "limitations": [
    "Cisco confirms Cloud-delivered Firewall, Cloud-delivered FMC, Secure Access and Secure Firewall Management Center are not affected",
    "ASA and FTD devices without SSL VPN enabled on any interface are not exposed",
    "Tunnel groups that use only primary authentication are not affected, provided no in-scope tunnel group including DefaultWEBVPNGroup has a secondary authentication server group",
    "The impact is a device reload (availability); Cisco does not describe code execution or data exposure"
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-76418-cisco-asa-ftd-ssl-vpn-dos-cisa-kev/corrections"
}