Key facts
- Cisco issued security fixes for CVE-2026-76418, a denial-of-service flaw in ASA and FTD software.
- Successful exploitation lets an unauthenticated, remote attacker trigger a denial-of-service condition by causing the affected device to reload unexpectedly.
- The issue arises from logic errors tied to secondary authentication on a tunnel group, and exploitation occurs when an attacker sends a crafted request during an SSL remote access VPN connection.
- Cisco provided no indicators of compromise and shared no specifics about the attacks, including the targeted organizations or the identity of the attackers.
Cisco issued security fixes for CVE-2026-76418, a denial-of-service zero-day in ASA and FTD software, in an advisory published October 28, 2026, as attackers actively exploited the flaw through the SSL VPN service to remotely crash vulnerable firewall devices.
Cisco’s Product Security Incident Response Team discovered evidence of in-the-wild exploitation earlier in October 2026 and said it became aware of the active attacks during that month. The flaw arises from logic errors tied to secondary authentication on a tunnel group, and exploitation occurs when an attacker sends a crafted request during an SSL remote access VPN connection. No successful VPN login is required to reach the affected processing path. The company put it this way: “An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN.”
A successful exploit lets an unauthenticated, remote attacker cause the affected device to reload unexpectedly, resulting in a denial-of-service condition. Exposure requires vulnerable ASA or FTD software, a reachable SSL remote access VPN login service, and secondary authentication configured in the tunnel group scope. Cisco rated the flaw 8.6 on the CVSS scale and assessed it as high severity. “A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition,” the company said.
The advisory names no attackers or victims, says there is no confirmed data theft or remote code execution, and offers no indicators of compromise or specifics about the attacks, the targeted organizations, or the identity of the attackers. The vulnerability does not affect Secure FMC, Cloud-delivered Firewall, cloud-delivered FMC, or Secure Access.
Cisco patched ASA Software Release 9.16 and earlier in version 9.16.4.104, 9.18 in 9.18.4.96, 9.20 in 9.20.4.50, 9.22 in 9.22.3.200, 9.23 in 9.23.1.48, and 9.24 in 9.24.1.27 and 9.24.10.1. For FTD, the company fixed Software Release 7.0 and earlier in 7.0.11, 7.2 in 7.2.13, 7.4 in 7.4.9, 7.6 in 7.6.7, 7.7 in 7.7.14, 10.0 in 10.0.3, and 10.1 in 10.1.1.
Shadowserver monitors over 51,000 Cisco ASA SSL VPN devices facing the internet. In August 2026, Cisco addressed CVE-2026-20349, a denial-of-service zero-day that attackers were actively exploiting to crash firewall devices with SSL listen sockets enabled. The team acknowledged the exploitation that month, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 11, 2026, with a federal remediation deadline of August 14, 2026. It caused unexpected device reloads without providing shell access, data exfiltration, or a persistent implant directly.
That August flaw had its own remediation track. Cisco shipped hot-fixes covering ASA 9.16.4.50, 9.18.4.50, 9.20.4.235, 9.22.3.191, 9.23.1.211, and 9.24.1.221, plus FTD hot-fix bundles for the 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 branches. Exposure ran through classic SSL VPN via the webvpn command on an enabled interface, IKEv2 remote access VPN using client services, or Zero Trust Network Access on FTD, and Cisco said turning off the affected VPN features was the sole mitigation besides installing the hot-fix.
Barely eleven months earlier, in September 2025, Cisco patched CVE-2025-20362 and CVE-2025-20333, two ASA and FTD flaws exploited in zero-day attacks aimed at 5500-X Series devices with VPN web services enabled; on that day CISA released Emergency Directive 25-03, directing federal agencies to protect Cisco firewall devices in under a day.
Cisco tied those incidents to the ArcaneDoor campaign, which exploited CVE-2024-20353 and CVE-2024-20359 to breach government networks beginning in November 2023, and says CVE-2026-76418 is separate from CVE-2025-20333 with different causes. Earlier in October 2026, Cisco warned customers to patch CVE-2026-76519, an actively exploited zero-day in Secure Email Gateway that lets unauthenticated attackers run commands remotely with root privileges.
Cisco offers no workaround for CVE-2026-76418. Administrators should turn off secondary authentication on any tunnel group list, including the default DefaultWEBVPNGroup, when it uses secondary authentication. When tunnel-group-list enable is configured, administrators should review every tunnel group, including DefaultWEBVPNGroup; when the command is absent or removed, the default DefaultWEBVPNGroup still requires a check because removing the group list does not eliminate exposure if that default group still relies on secondary authentication. Eric Fernald found the problem while handling a Cisco Technical Assistance Center support case.
Cisco urges customers to patch and run its Software Checker to verify exposed releases and pick suitable fixed software before planning upgrades.
Join the discussion