Cisco says attackers are actively exploiting CVE-2026-76418, a high-severity flaw in its Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. A crafted request to the SSL VPN login can make the device reload, cutting off remote access for everyone who relies on it. Only devices with a specific VPN setup are affected, so checking your configuration is the first step.
What happened
Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 on October 28, 2026. It describes a denial-of-service flaw in the remote access SSL VPN feature, caused by logic errors when secondary authentication is configured on a tunnel group. An unauthenticated remote attacker can send a crafted request while connecting and force the device to reload. Cisco rates it 8.6 (High) and says a successful VPN login is not needed to reach the vulnerable code path.
Cisco states that its product security team became aware of active exploitation in October 2026. It has not said who is exploiting the flaw, how many devices were hit, or published indicators of compromise. A third-party report from Rescana says CISA added the bug to its Known Exploited Vulnerabilities catalog on October 29 with a November 1 deadline for federal agencies; we could not open CISA’s own alert to confirm that, so treat the KEV details as reported, not verified.
Who is affected
A device is affected only if all three conditions hold: it runs a vulnerable ASA or FTD release, the SSL remote access VPN login service is reachable, and secondary authentication is set on a tunnel group. Cisco warns that the check covers every tunnel group, including the default one (DefaultWEBVPNGroup), even when profiles are hidden from the login page. Removing the tunnel group list does not remove the exposure if the default group uses secondary authentication. Cisco lists its cloud-delivered firewall, cdFMC, Secure Access and Secure FMC software as not affected.
What to do
Cisco strongly recommends upgrading to a fixed release. First fixed versions per Cisco:
- ASA: 9.16 and earlier: 9.16.4.104; 9.18: 9.18.4.96; 9.20: 9.20.4.50; 9.22: 9.22.3.200; 9.23: 9.23.1.48; 9.24: 9.24.1.27 or 9.24.10.1.
- FTD: 7.0 and earlier: 7.0.11; 7.2: 7.2.13; 7.4: 7.4.9; 7.6: 7.6.7; 7.7: 7.7.14; 10.0: 10.0.3; 10.1: 10.1.1.
If you cannot upgrade right away, Cisco describes a mitigation (it says there are no true workarounds, and that it tested this only in a lab). If DefaultWEBVPNGroup does not use secondary authentication, run no tunnel-group-list enable in WebVPN configuration mode; users then need to know their tunnel-group name. If the default group does use secondary authentication, no secondary-authentication-server-group removes the exposure but lowers VPN security, so weigh that trade-off.
Our analysis, not Cisco’s guidance: audit your tunnel groups today, schedule the upgrade ahead of routine maintenance, and watch device logs for unexplained reloads, which could point to attempted exploitation. On FTD, review the deployed remote access VPN policy in FMC or FDM.
What we still do not know
Cisco has not named the attackers, the scale, or the exact date exploitation began. The impact Cisco describes is a reload rather than code execution or data theft, so in our reading the risk is outage rather than intrusion, though Cisco has not detailed what attackers actually did. We also have not independently confirmed the CISA catalog entry and its deadline.
Sources: Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 (Oct 28, 2026); Rescana analysis citing CISA KEV (Oct 30, 2026).
Leave a Reply