Short answer: CVE-2026-76418 lets an unauthenticated attacker on the internet crash (reload) a Cisco ASA or FTD firewall that has the SSL VPN turned on and secondary authentication set on a tunnel group. Cisco published the fix on 28 October 2026, saw real attacks in October 2026, and CISA added it to its Known Exploited Vulnerabilities list on 29 October 2026. If you run one of these firewalls, upgrade to the first fixed release listed in Cisco's advisory.
TL;DR
- What: a denial-of-service (DoS) bug in the Remote Access SSL VPN service of Cisco ASA and FTD software.
- Who is at risk: firewalls with SSL VPN enabled and secondary authentication configured in a tunnel group.
- Impact: the firewall restarts, so VPN users and network traffic are cut off. No data theft is described.
- Status: exploited in the wild (Cisco, CISA KEV). Patches are out. No full workaround, only a mitigation.
- Do now: check your version and config, then upgrade.
What is CVE-2026-76418?
CVE-2026-76418 is a vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. Cisco says the bug is caused by "logic errors when secondary authentication is configured on a tunnel group". An attacker can send "a crafted request when connecting to the SSL remote access VPN" and make the device reload (Cisco advisory).
In simple words: the firewall's VPN login page has a bug. If the firewall asks for a second login check (secondary authentication), a specially made request can confuse it and make it restart. While it restarts, people cannot connect, and traffic going through the firewall stops. Cisco also notes that "a successful VPN login is not required to reach the affected processing path", so the attacker does not need any account.
Key terms, explained simply
- ASA and FTD
- Two kinds of software that run on Cisco firewalls. A firewall is the security gate between a company network and the internet.
- SSL VPN (remote access VPN)
- A secure tunnel that lets employees connect to the office network from home through a web or client login.
- Tunnel group
- A VPN "connection profile". It decides how users log in.
DefaultWEBVPNGroupis the built-in default one. - Secondary authentication
- A second login check after the first one, for example a second password server.
- Denial of service (DoS)
- An attack that stops a service from working. Here, the firewall restarts.
- CISA KEV
- The US government's list of vulnerabilities known to be used in real attacks.
Key facts at a glance
| Item | Detail | Source |
|---|---|---|
| CVE | CVE-2026-76418 | NVD |
| Products | Cisco Secure Firewall ASA Software; Cisco Secure FTD Software | Cisco |
| Not affected | Cloud-delivered Firewall, cdFMC, Secure Access, Secure FMC Software | Cisco |
| CVSS 3.1 | 8.6 High (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), scored by Cisco | Cisco, NVD |
| CWE | CWE-690: unchecked return value to NULL pointer dereference | NVD, CISA KEV |
| Cisco bug ID | CSCwx26625 | Cisco |
| Exploited? | Yes. Cisco PSIRT became aware of active exploitation in October 2026 | Cisco, CISA KEV |
| Workaround | None. A temporary mitigation exists (see fix section) | Cisco |
| Found by | Eric Fernald, during a Cisco TAC support case | Cisco |
Which versions fix it?
Cisco lists the first fixed release for each software train. Any version older than these on the same train is affected (Cisco advisory, Fixed Software).
| ASA release | First fixed | FTD release | First fixed |
|---|---|---|---|
| 9.16 and earlier | 9.16.4.104 | 7.0 and earlier | 7.0.11 |
| 9.18 | 9.18.4.96 | 7.2 | 7.2.13 |
| 9.20 | 9.20.4.50 | 7.4 | 7.4.9 |
| 9.22 | 9.22.3.200 | 7.6 | 7.6.7 |
| 9.23 | 9.23.1.48 | 7.7 | 7.7.14 |
| 9.24 | 9.24.1.27 or 9.24.10.1 | 10.0 | 10.0.3 |
| 10.1 | 10.1.1 |
How does the CVE-2026-76418 attack work?
- Find a target. The attacker looks for a Cisco firewall whose SSL VPN login service is reachable from the internet. BleepingComputer reports that Shadowserver tracks more than 51,000 internet-exposed Cisco ASA SSL VPN devices; not all of them are vulnerable (BleepingComputer).
- Send a crafted request. While "connecting" to the VPN, the attacker sends a specially made request. No login is needed.
- Hit the bug. If a tunnel group uses secondary authentication, a logic error is triggered. NVD and CISA classify the weakness as CWE-690, an unchecked return value that leads to a NULL pointer dereference.
- Firewall reloads. The device restarts. Repeating the attack can keep the VPN and network unstable.
Cisco has not published exploit code or the exact request, and we do not either. This is a crash (availability) bug: the CVSS vector says confidentiality and integrity impact are "None".
MITRE ATT&CK mapping
Cisco and CISA did not publish an ATT&CK mapping. Skillmate analyst mapping (our judgement): T1499.004 Endpoint Denial of Service: Application or System Exploitation, because the attacker exploits a software bug to crash the device.
When did this happen? Timeline
| Date | Event | Source |
|---|---|---|
| August 2026 | Cisco fixes a different exploited ASA/FTD SSL VPN DoS bug, CVE-2026-20349 | SecurityWeek |
| October 2026 | Cisco PSIRT learns CVE-2026-76418 is being exploited | Cisco |
| 28 Oct 2026, 19:15 GMT (29 Oct, 00:45 IST) | Cisco publishes advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 with fixes | Cisco |
| 28 Oct 2026, 20:18 UTC | CVE published in NVD | NVD |
| 29 Oct 2026 | CISA adds it to the KEV catalog; US federal agencies must act by 1 Nov 2026 | CISA KEV |
| 29 Oct 2026 | BleepingComputer, The Hacker News and SecurityWeek report the zero-day | News |
Am I affected by CVE-2026-76418?
According to Cisco, a device is affected only when all three are true:
- It runs a vulnerable ASA or FTD release (older than the fixed versions above).
- The SSL remote access VPN login service is reachable. The running config contains
webvpnandenable <interface_name>on at least one interface. - Secondary authentication (
secondary-authentication-server-group) is set in a tunnel group. Iftunnel-group-list enableis on, check every tunnel group, includingDefaultWEBVPNGroup. If it is off, still checkDefaultWEBVPNGroup.
On FTD, check the deployed remote access VPN policy in Secure Firewall Management Center (FMC) or Firewall Device Manager (FDM). Cisco's Software Checker can confirm whether your exact release is affected.
Safe, read-only commands to check an ASA
Run these only on devices you own or are authorised to manage. They only display information and change nothing.
! 1. Software version and uptime (an unexpected recent uptime can mean a reload)
show version
! 2. Is SSL VPN enabled on an interface? Is the tunnel group list on?
show running-config webvpn
! 3. Which tunnel groups use secondary authentication?
show running-config tunnel-group | include tunnel-group|secondary-authentication-server-group
How to read it: if step 2 shows enable on an interface, and step 3 shows secondary-authentication-server-group under any relevant tunnel group, and your version is older than the fixed release, treat the device as vulnerable.
How do I fix CVE-2026-76418?
- Upgrade (the real fix). Move to the first fixed release for your train from Cisco's advisory. For FTD, follow the Cisco Secure FMC upgrade guide linked from that advisory.
- If you cannot upgrade today, use Cisco's temporary mitigation.
- If
DefaultWEBVPNGroupdoes not use secondary authentication: in webvpn configuration mode runno tunnel-group-list enable. Users then must know their connection profile name. - If
DefaultWEBVPNGroupdoes use secondary authentication: remove it withno secondary-authentication-server-group. Cisco warns this "lowers" remote access VPN security.
- If
- Test first. Cisco says to check any mitigation in your own environment before deploying it, and to treat it as temporary.
- Check related Cisco firewall advisories at the same time, including Cisco's August 2026 Remote Access SSL VPN DoS advisory, which SecurityWeek identifies as CVE-2026-20349.
How can I check for signs of an attack?
Cisco has not released indicators of compromise (IOCs) for this bug (BleepingComputer), so there is no official IP list or signature. Practical checks a defender can do:
- Unexpected reloads. Compare
show versionuptime with your change records. A reload you did not plan, on a VPN-facing firewall, deserves a closer look. - Crash files. On ASA,
show crashinfodisplays saved crash information. If you find one, open a Cisco TAC case and share it with them. - Logs around the reload. In your SIEM, look at VPN connection attempts from unfamiliar IP addresses in the minutes before the device went down.
False positives and limits: firewalls also restart because of planned upgrades, power or hardware problems, failover events, and other bugs (including CVE-2026-20349). A reload alone does not prove this exploit. Because the attack needs no login, there may be no failed-login trail to search.
What is confirmed and what is not?
| Confirmed (by Cisco, NVD or CISA) | Not confirmed / not public |
|---|---|
| Unauthenticated, remote attacker can reload the device | Who is exploiting it |
| Exploited in the wild (Cisco, October 2026; CISA KEV) | How many organisations were hit, and which ones |
| Needs SSL VPN on and secondary authentication in a tunnel group | Any IOCs, IP addresses or exploit code |
| CVSS 8.6, CWE-690; fixed versions listed by Cisco | Whether the same actor exploited CVE-2026-20349 (SecurityWeek says this is unclear) |
| Impact is availability only (CVSS C:N/I:N/A:H) | Link to ransomware: CISA lists this as "Unknown" |
Why does this matter?
A firewall VPN is how many companies let staff work from home. If an attacker can restart it at will, remote work stops and the network can go down for minutes at a time. This is also the second exploited ASA/FTD SSL VPN crash bug since August 2026, according to SecurityWeek. Internet-facing edge devices keep getting targeted, which is why patching them quickly is a core job for security teams.
For students, this is a clear example of how a small logic mistake in a login path can become a real-world outage, and of how defenders use vendor advisories, NVD and CISA KEV together to decide what to patch first.
What should I learn next?
- Practise reading firewall configs, VPN logs and patch advisories in hands-on labs at Skillmate Labs.
- Want guided training for SOC and network security roles? Register for the Skillmate cybersecurity training programme.
Frequently asked questions
Is CVE-2026-76418 being exploited?
Yes. Cisco says its PSIRT became aware of active exploitation in October 2026, and CISA added CVE-2026-76418 to its Known Exploited Vulnerabilities catalog on 29 October 2026.
Can CVE-2026-76418 be used to steal data or run code?
Not according to the official sources. Cisco describes it as a denial-of-service bug that makes the device reload, and the CVSS vector rates confidentiality and integrity impact as None.
Does the attacker need a VPN username or password?
No. Cisco says the attacker is unauthenticated and that a successful VPN login is not required to reach the vulnerable code.
Is there a workaround for CVE-2026-76418?
There is no full workaround. Cisco gives a temporary mitigation: disable the tunnel group list, or remove secondary authentication from affected tunnel groups, which lowers VPN security. Upgrading is the recommended fix.
Which Cisco products are not affected?
Cisco says Cloud-delivered Firewall, Cloud-delivered Firewall Management Center, Secure Access and Secure FMC Software are not affected.
Sources
- Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 (vendor, primary), 28 Oct 2026
- NVD entry for CVE-2026-76418 (official CVE record)
- CISA Known Exploited Vulnerabilities catalog, added 29 Oct 2026
- BleepingComputer: New Cisco firewall zero-day exploited to crash SSL VPN devices, 29 Oct 2026
- SecurityWeek: Attackers exploit second Cisco firewall VPN zero-day since August, 29 Oct 2026
- The Hacker News: Cisco patches actively exploited ASA and FTD VPN flaw, 29 Oct 2026
How we wrote this: every fact above was checked against the Cisco advisory, NVD and CISA KEV on 1 Nov 2026 and cross-checked with three independent news reports. Commands are read-only and taken from Cisco's configuration checks. Found an error? Tell us via the comments below and we will correct it and update the date at the top.
