{"type":"bundle","id":"bundle--733c32dd-7f24-50c9-9c62-9d2a830dde4d","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--aa071980-dc91-5812-b0e6-e6435a69a41a","created":"2026-10-29T19:59:03.378Z","modified":"2026-10-29T19:59:03.378Z","name":"Cisco ASA and FTD SSL VPN crash bug exploited as a zero-day: unauthenticated reloads via secondary authentication (CVE-2026-76418, CISA KEV)","description":"On 2026-10-28 Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418 (CVSS 8.6, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, CWE-690), a denial-of-service bug in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Logic errors when secondary authentication is configured on a tunnel group let an unauthenticated remote attacker send a crafted request while connecting to the SSL VPN and make the device reload; a successful VPN login is not required. A device is vulnerable only if it runs an affected release, the SSL VPN login service is reachable (webvpn enabled on an interface), and secondary-authentication-server-group is set on an in-scope tunnel group: every tunnel group including DefaultWEBVPNGroup when tunnel-group-list enable is configured, otherwise DefaultWEBVPNGroup. Cisco PSIRT became aware of active exploitation in October 2026. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-10-29 (version 2026.10.29) with a 2026-11-01 due date; forensic triage is not required and ransomware use is unknown. SecurityWeek and BleepingComputer report it is the second ASA/FTD VPN denial-of-service zero-day since August, after CVE-2026-20349.","aliases":["CVE-2026-76418","cisco-sa-asaftd-tunnel-dos-s6mgkb75","CSCwx26625","Cisco Secure Firewall ASA and FTD Remote Access SSL VPN Tunnel Denial of Service Vulnerability","Cisco ASA FTD SSL VPN zero-day October 2026","Cisco firewall VPN reload exploit"],"first_seen":"2026-10-01T00:00:00Z","last_seen":"2026-10-29T19:52:32Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75"},{"source_name":"CISA Known Exploited Vulnerabilities catalog feed (version 2026.10.29)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"},{"source_name":"Cisco ASA 9.18.4 interim release notes (9.18.4.96 fixes CSCwx26625)","url":"https://www.cisco.com/web/software/280775065/166425/ASA-9184-Interim-Release-Notes.html"},{"source_name":"SecurityWeek: Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August","url":"https://www.securityweek.com/attackers-exploit-second-cisco-firewall-vpn-zero-day-since-august/"},{"source_name":"BleepingComputer: New Cisco firewall zero-day exploited to crash SSL VPN devices","url":"https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/"},{"source_name":"HOL Guard operator write-up: Cisco ASA and FTD CVE-2026-76418 on CISA KEV","url":"https://hol.org/blog/cve-2026-76418-cisco-asa-ftd-ssl-vpn-dos-cisa-kev"}]}]}