Loading vulnerability…
Cisco ASA and FTD SSL VPN Secondary Authentication Denial of Service
CVE-2026-76418 is a denial-of-service vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. Logic errors in processing connections to a tunnel group configured with secondary authentication allow an unauthenticated remote attacker to send a crafted VPN connection request that triggers an unexpected device reload. Successful VPN authentication is not required. The vulnerability has a CVSS v3.1 base score of 8.6, and Cisco became aware of active exploitation in October 2026.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation forces the affected firewall to reload, causing denial of service and disrupting remote-access VPN connectivity and other services provided by the device. Repeated exploitation could prolong service disruption. The published CVSS assessment specifies high availability impact and no confidentiality or integrity impact; remote code execution and data theft are not established outcomes.
If you can’t patch tonight, do this now.
Cisco identifies no workaround that fully addresses the vulnerability, but provides temporary configuration-based mitigations. If DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel-group list using 'no tunnel-group-list enable' in WebVPN configuration mode; users must then know their connection profile rather than select it from a displayed list. If DefaultWEBVPNGroup uses secondary authentication, remove that configuration using 'no secondary-authentication-server-group'; disabling the group list alone does not eliminate this exposure. When assessing exposure with the tunnel-group list enabled, inspect every tunnel group, including DefaultWEBVPNGroup, rather than only profiles displayed on the login page. Removing secondary authentication weakens VPN security. Review operational and security consequences and validate mitigation effectiveness in the deployed environment; these measures do not replace upgrading.
Patch, then assume compromise.
Upgrade to the appropriate Cisco-fixed release for the deployed software branch and platform. Listed ASA fixed releases are 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, and 9.24.10.1. Listed FTD fixed releases are 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1. Confirm the applicable upgrade target and installation requirements using Cisco's advisory and Software Checker. Prioritize patching because active exploitation has been observed.
No public exploits tracked yet. Mallory keeps watching.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.