All Articles

CVE-2026-76418 is an actively exploited denial-of-service flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. An unauthenticated remote attacker can force the device to reload when secondary authentication is configured on a tunnel group. Cisco published the advisory on Oct 28, 2026, rated it CVSS 8.6 (High), and says it is aware of active exploitation; CISA added it to the KEV catalog on Oct 29. There is no workaround, only a mitigation that weakens VPN security.

What happened with CVE-2026-76418?

• Oct 2026: Cisco PSIRT became aware of active exploitation (Cisco advisory).
• Oct 28, 2026, 19:15 GMT: Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 (Bug ID CSCwx26625).
• Oct 29, 2026: CISA added CVE-2026-76418 to the KEV catalog, with a Nov 1, 2026 deadline for federal agencies (CISA, The Hacker News). Cisco has not disclosed when attacks began, who is behind them, or their scale.

The flaw was found by Eric Fernald during a Cisco TAC support case.

How does the attack work?

Per Cisco, the cause is "logic errors when secondary authentication is configured on a tunnel group" (CWE-690). A crafted request sent to the SSL VPN login service causes the device to reload. A successful VPN login is not required to reach the vulnerable code path. CVSS vector: AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H — no confidentiality or integrity impact, high availability impact.

Our read: A firewall reload drops every VPN session and can interrupt perimeter inspection. Repeated reloads are an outage of remote access; treat this as an availability incident risk, not a low-priority DoS.

Who is affected?

All three conditions must be true:

1. SSL VPN enabled on at least one interface (webvpn with enable <interface_name>).
2. Secondary authentication configured on a tunnel group.
3. The login service is reachable.

Not affected: Cloud-delivered Firewall, cdFMC, Cisco Secure Access, Secure FMC Software.

First fixed releases

What should CISOs do this week?

1. Inventory every ASA and FTD appliance with SSL VPN enabled and record its release against the table above.
2. Check every tunnel group — including DefaultWEBVPNGroup and groups not shown on the login page — for secondary-authentication-server-group. On FTD, review Devices > VPN > Remote Access in FMC, or Remote Access VPN in FDM.
3. Upgrade exposed devices to the first fixed release. Cisco states no workaround fixes the flaw.
4. If you cannot upgrade immediately, apply Cisco's mitigation: if DefaultWEBVPNGroup does not use secondary authentication, run no tunnel-group-list enable (users must then know their connection profile name); otherwise run no secondary-authentication-server-group, accepting the reduced VPN security posture. Note Cisco's warning that disabling the group list alone does not remove exposure if the default group uses secondary authentication.
5. Review device logs for unexpected reloads since early October 2026 and treat unexplained reloads as possible exploitation. Cisco lists no IOCs.

Test yourself: how a red team would check exposure

• Enumerate internet-facing SSL VPN login portals in your attack surface and map them to ASA/FTD assets and releases.
• Validate configuration, not exploitability: confirm via running config which reachable portals have secondary authentication on any tunnel group. Do not send crash-inducing traffic to production appliances; there is no public safe check in Cisco's advisory.

Lessons for the security program

• Edge-device configuration (here, secondary authentication on a hidden tunnel group) changes exposure; asset inventory needs config attributes, not only versions.
• Keep a tested, fast-track upgrade path for perimeter appliances: Cisco firewall flaws have reached active exploitation repeatedly in 2026, including CVE-2026-20349 in August (SecurityWeek).

CISOs in the CISO Platform community are comparing notes on firewall VPN exposure this week. Join 6K+ security leaders →

FAQ

What is CVE-2026-76418?
An unauthenticated denial-of-service flaw in the Remote Access SSL VPN service of Cisco ASA and FTD software, CVSS 8.6, caused by logic errors when secondary authentication is configured on a tunnel group.

Is CVE-2026-76418 being exploited?
Yes. Cisco states it became aware of active exploitation in October 2026, without details on attackers or scale. CISA added it to KEV on Oct 29, 2026.

Is there a workaround?
No. Cisco offers a mitigation (disabling the tunnel group list or secondary authentication) that reduces VPN security; upgrading is the fix.

Does it require valid VPN credentials?
No. Cisco says a successful VPN login is not required to reach the vulnerable code.

Is Cisco Secure FMC affected?
No. FMC, cdFMC, Cloud-delivered Firewall and Cisco Secure Access are not affected.

Handled an incident like this or run a red team that found it? Write it up for CISO Platform peers →

Related on CISO Platform

• GitLab CVE-2026-97229 exploited: CI/CD RCE added to CISA KEV
• Exploited this week: Plex2Shell, Arista, VeloCloud, Collabora
• PHP2Shell (CVE-2026-109618/109619) technical analysis
• Weekly Threat Briefing Oct 22–29, 2026

Sources

• Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75
• CISA — Adds two known exploited vulnerabilities to catalog (Oct 29, 2026)
• The Hacker News — Cisco Patches Actively Exploited ASA and FTD VPN Flaw (Oct 29, 2026)
• SecurityWeek — Cisco Patches Firewall Zero-Day Exploited for DoS Attacks (CVE-2026-20349)