Cisco ASA and FTD firewalls: SSL VPN crash flaw CVE-2026-76418 exploited; fixes released
Cisco says attackers are exploiting CVE-2026-76418, which lets anyone on the internet make ASA and FTD firewalls with SSL VPN reload. Fixed releases are out. Businesses and IT providers should upgrade now; homes are unlikely to run these.
If your business or IT provider runs Cisco ASA or FTD with SSL VPN, upgrade to a fixed release listed in Cisco's advisory; until then, disable secondary authentication on tunnel groups as a stopgap. Families are unlikely to use these devices and need do nothing.
What’s happening
Cisco has warned that attackers are exploiting CVE-2026-76418, a flaw in the remote access SSL VPN feature of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. An unauthenticated attacker over the network can make the device reload unexpectedly, cutting off VPN and firewall services. Cisco rates it 8.6 (high). Devices are affected when SSL VPN (the webvpn setting) is enabled on an interface and a secondary authentication server group is set in a tunnel group. Cisco published the advisory on 28 October 2026 with fixed releases for each software train, and CISA added the flaw to its exploited list on 29 October. Cisco has not said who is exploiting it or who was targeted, and has published no indicators of compromise. No full workaround exists. As a temporary measure, Cisco says to disable secondary authentication on the default tunnel group and any user-configured tunnel groups, but it recommends upgrading. Cisco's cloud-delivered firewall products and Secure FMC are not affected. Shadowserver counts more than 51,000 internet-exposed ASA SSL VPN devices.
- What
- Flaw
- Affects
- Cisco Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software
- Affected
- Cisco ASA and FTD software releases with SSL remote access VPN (webvpn) enabled on an interface and secondary-authentication-server-group set in a tunnel group
- Fixed in
- ASA 9.16.4.104
ASA 9.18.4.96
ASA 9.20.4.50
ASA 9.22.3.200
ASA 9.23.1.48
ASA 9.24.1.27 and 9.24.10.1
FTD 7.0.11
FTD 7.2.13
FTD 7.4.9
FTD 7.6.7
FTD 7.7.14
FTD 10.0.3
FTD 10.1.1 - Since
- 28 Oct 2026
Timeline
- CISA added
CISA added CVE-2026-76418 to its Known Exploited Vulnerabilities list. BleepingComputer reported that Cisco had not named the attackers, targets or indicators of compromise, and that Shadowserver tracked more than 51,000 internet-exposed Cisco ASA SSL VPN devices.
- Made publicFixed
Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418, an SSL VPN denial-of-service flaw in ASA and FTD software, with fixed releases for every listed train. Cisco said its PSIRT was aware of active exploitation in October 2026.
Sources
- Cisco Secure Firewall ASA and FTD Software Remote Access SSL VPN Tunnel Denial of Service VulnerabilityCisco · 28 Oct 2026
- Cisco warns of firewall zero-day exploited to crash SSL VPN devicesBleepingComputer · 29 Oct 2026