In this article
  1. What happened
  2. Why it matters
  3. What to do now
  4. Updates

Vulnerability summary

Per the vendor advisory, Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75, "Cisco Secure Firewall ASA and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability" (version 1.0, Oct 28, 2026), checked .

CVE
CVE-2026-76418
Exploited?
Yes, according to Cisco: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." Cisco doesn't say who was attacked. At our check the flaw wasn't in CISA's Known Exploited Vulnerabilities catalog (version 2026.10.28).

Who is affected and what fixes it

Who is affected and what fixes it, per the vendor advisory
ProductAffectedFirst fixed releaseSource
Cisco Secure Firewall ASA Software 9.16 and earlierBuilds before 9.16.4.104, with SSL remote access VPN enabled and secondary authentication on a tunnel group9.16.4.104Cisco advisory, checked
Cisco Secure Firewall ASA Software 9.18, 9.20, 9.22, 9.23Builds before the fixed release in each train, with the same VPN setup9.18.4.96, 9.20.4.50, 9.22.3.200 or 9.23.1.48Cisco advisory, checked
Cisco Secure Firewall ASA Software 9.24Builds before the fixed release, with the same VPN setup9.24.1.27 or 9.24.10.1Cisco advisory, checked
Cisco Secure Firewall Threat Defense (FTD) 7.0 and earlier, 7.2, 7.4Builds before the fixed release in each train, with remote access VPN and secondary authentication7.0.11, 7.2.13 or 7.4.9Cisco advisory, checked
Cisco Secure Firewall Threat Defense (FTD) 7.6, 7.7, 10.0, 10.1Builds before the fixed release in each train, with the same VPN setup7.6.7, 7.7.14, 10.0.3 or 10.1.1Cisco advisory, checked

Patch checklist

  1. Check whether SSL VPN is on: look for webvpn with enable <interface> in the running configuration (on FTD, Devices > VPN > Remote Access in Secure Firewall Management Center, or Remote Access VPN in Device Manager).
  2. Check every tunnel group, including DefaultWEBVPNGroup, for secondary-authentication-server-group. Cisco says to check all groups if tunnel-group-list enable is set, and DefaultWEBVPNGroup even if it isn't.
  3. Cisco's advice: upgrade to the first fixed release for your train (table above), or use the Cisco Software Checker to find a release that fixes all current advisories.
  4. If a partner or MSP manages your firewall, ask them to confirm the version and the date it was upgraded.

If you can't update yet

  • Cisco has no workaround, only a mitigation: if DefaultWEBVPNGroup doesn't use secondary authentication, enter no tunnel-group-list enable in WebVPN configuration mode (users then have to know their connection profile name).
  • If DefaultWEBVPNGroup does use secondary authentication, Cisco's mitigation is no secondary-authentication-server-group, which Cisco warns lowers your remote access VPN security. Cisco calls both temporary; plan the upgrade anyway.

How to check for compromise

  • Our advice: check the firewall's uptime and logs for unexpected reloads since early October. Cisco describes this flaw as a crash (denial of service), not a takeover, but repeated reloads cut off remote staff and are worth reporting to Cisco TAC.

Full steps and context: What to do now

TL;DR: Cisco says attackers are exploiting CVE-2026-76418, a flaw in the SSL remote access VPN of its Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. An unauthenticated attacker on the internet can make the firewall reload, cutting off the network and VPN users. Only firewalls with SSL VPN turned on and secondary authentication set on a tunnel group are exposed. Cisco has no workaround: upgrade to the fixed release for your version, such as ASA 9.22.3.200 or FTD 7.4.9.

What happened

Cisco published security advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 on October 28, 2026, at 19:15 GMT (3:15 a.m. on October 29, Manila time). It rates the flaw High, with a CVSS 3.1 base score of 8.6.

The flaw: Cisco says logic errors when secondary authentication is configured on a tunnel group let an unauthenticated, remote attacker send a crafted request while connecting to the SSL remote access VPN. A successful attack makes the device reload, a denial of service. Cisco notes that “a successful VPN login is not required” to reach the faulty code.

Who is affected: Firewalls running a vulnerable ASA or FTD release where the SSL VPN login page is reachable and secondary authentication is configured on a tunnel group. Cisco lists every ASA train from 9.16 and earlier through 9.24, and every FTD train from 7.0 and earlier through 10.1, until the fixed builds below. Cisco says its cloud-delivered firewall, cloud-delivered Firewall Management Center, Secure Access and Secure Firewall Management Center software aren’t hit by this flaw.

The fix: ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 or 9.24.10.1. FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 or 10.1.1.

Exploitation: Cisco says that “in October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” It doesn’t say who was targeted. Cisco credits Eric Fernald, who found the flaw while resolving a Cisco Technical Assistance Center (TAC) support case. CISA hadn’t added it to its Known Exploited Vulnerabilities catalog at our check. CISA’s SSVC assessment in the CVE record, dated October 28 (UTC), lists exploitation as “none”, which conflicts with Cisco’s statement.

Why it matters

A firewall is the front door of an office network, and for many small companies it’s also how remote staff connect. Each reload drops every connection through it, including remote staff on the VPN. VPN login pages have to face the internet, which makes them an easy target to find. Many small offices have an outside IT partner running the firewall, so check who handles yours. Our Security hub tracks other patches worth doing now, including the HPE Aruba controller fixes.

What to do now

  1. Check whether you’re exposed. Our advice, based on Cisco’s advisory: look for webvpn with enable <interface> in the running configuration, then check each tunnel group, including DefaultWEBVPNGroup, for secondary-authentication-server-group. On FTD, review the remote access VPN policy in Secure Firewall Management Center or Device Manager.
  2. Upgrade. Install the first fixed release for your train: ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 or 9.24.10.1; FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 or 10.1.1. Cisco’s Software Checker shows the release that also fixes its other advisories.
  3. If you can’t upgrade today, Cisco’s mitigation is to disable the tunnel group list (no tunnel-group-list enable) when DefaultWEBVPNGroup doesn’t use secondary authentication, or else remove secondary authentication (no secondary-authentication-server-group). Cisco warns the second option weakens VPN security and calls both temporary.
  4. Ask your IT partner. If someone else runs the firewall, ask them today which version it’s on and when it will be upgraded.

Updates

  • Oct 29, 2026, 1:20 p.m. Manila: First published.

Sources & method

Sources

Method. Checked October 29, 2026, at 12:45 p.m. Manila time (04:45 UTC). The affected setup, fixed releases, CVSS score, mitigation and exploitation statement come from Cisco’s advisory. CISA’s SSVC assessment comes from the CVE record; we also checked NVD. We checked the KEV catalog (version 2026.10.28) for the CVE. Steps labelled “our advice” are our own judgment, not Cisco’s. The thumbnail is the alert icon on Cisco’s advisory page, placed on a white background. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.