{"id":"cisco-asa-ftd-ssl-vpn-dos-cve-2026","category":"patch","status":"live","title":"Cisco ASA and FTD firewalls: SSL VPN crash flaw CVE-2026-76418 exploited; fixes released","tldr":"Cisco says attackers are exploiting CVE-2026-76418, which lets anyone on the internet make ASA and FTD firewalls with SSL VPN reload. Fixed releases are out. Businesses and IT providers should upgrade now; homes are unlikely to run these.","summary":"Cisco has warned that attackers are exploiting CVE-2026-76418, a flaw in the remote access SSL VPN feature of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. An unauthenticated attacker over the network can make the device reload unexpectedly, cutting off VPN and firewall services. Cisco rates it 8.6 (high). Devices are affected when SSL VPN (the webvpn setting) is enabled on an interface and a secondary authentication server group is set in a tunnel group. Cisco published the advisory on 28 October 2026 with fixed releases for each software train, and CISA added the flaw to its exploited list on 29 October. Cisco has not said who is exploiting it or who was targeted, and has published no indicators of compromise. No full workaround exists. As a temporary measure, Cisco says to disable secondary authentication on the default tunnel group and any user-configured tunnel groups, but it recommends upgrading. Cisco's cloud-delivered firewall products and Secure FMC are not affected. Shadowserver counts more than 51,000 internet-exposed ASA SSL VPN devices.","action":"If your business or IT provider runs Cisco ASA or FTD with SSL VPN, upgrade to a fixed release listed in Cisco's advisory; until then, disable secondary authentication on tunnel groups as a stopgap. Families are unlikely to use these devices and need do nothing.","product":"Cisco Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-76418"],"tags":["cisco","asa","ftd","firewall","vpn","denial-of-service","zero-day","cisa-kev"],"affected":["Cisco ASA and FTD software releases with SSL remote access VPN (webvpn) enabled on an interface and secondary-authentication-server-group set in a tunnel group"],"fixed":["ASA 9.16.4.104","ASA 9.18.4.96","ASA 9.20.4.50","ASA 9.22.3.200","ASA 9.23.1.48","ASA 9.24.1.27 and 9.24.10.1","FTD 7.0.11","FTD 7.2.13","FTD 7.4.9","FTD 7.6.7","FTD 7.7.14","FTD 10.0.3","FTD 10.1.1"],"matches":[],"sources":[{"kind":"advisory","title":"Cisco Secure Firewall ASA and FTD Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75","by":"Cisco","date":"2026-10-28"},{"kind":"news","title":"Cisco warns of firewall zero-day exploited to crash SSL VPN devices","url":"https://bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices","by":"BleepingComputer","date":"2026-10-29"}],"started":"2026-10-28","closed":null,"created":"2026-11-03T22:04:13.230Z","updated":"2026-11-03T22:04:13.230Z","cve_notes":[{"cve":"CVE-2026-76418","name":"Unchecked return value crash in Cisco ASA/FTD SSL VPN","what":"An unchecked return value leading to a NULL pointer dereference in the remote access SSL VPN service of Cisco ASA and FTD software, which an unauthenticated attacker over the network can use to force the device to reload and cause a denial of service.","severity":"high","cvss":8.6}],"timeline":[{"at":"2026-10-29","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added CVE-2026-76418 to its Known Exploited Vulnerabilities list. BleepingComputer reported that Cisco had not named the attackers, targets or indicators of compromise, and that Shadowserver tracked more than 51,000 internet-exposed Cisco ASA SSL VPN devices.","url":"https://bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices","by":"BleepingComputer","patch":null},{"at":"2026-10-28","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418, an SSL VPN denial-of-service flaw in ASA and FTD software, with fixed releases for every listed train. Cisco said its PSIRT was aware of active exploitation in October 2026.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75","by":"Cisco","patch":"patched"}],"url":"https://hard.fyi/live/cisco-asa-ftd-ssl-vpn-dos-cve-2026/","json":"https://hard.fyi/api/live?id=cisco-asa-ftd-ssl-vpn-dos-cve-2026"}