Cisco ASA FTD VPN Flaw CVE-2026-76418 Patch Now

Cisco has confirmed active exploitation of CVE-2026-76418, a denial-of-service flaw in Secure Firewall ASA and FTD software that lets an unauthenticated remote attacker crash and reload the device during an SSL VPN connection attempt. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 29, 2026, with a remediation deadline of November 1, 2026. If you run ASA or FTD with remote-access SSL VPN, the short version is: check whether secondary authentication is configured on your tunnel groups, apply Cisco's fix, and upgrade to a patched release as soon as possible.

What happened

Cisco published security advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 on October 28, 2026, disclosing a logic error (CWE-690, unchecked return value leading to a NULL pointer dereference) in how ASA and FTD software handle SSL remote-access VPN connection attempts when a tunnel group uses secondary authentication. An attacker who sends a crafted request during the VPN connection process — without ever completing a successful login — can trigger the flaw and force the device to reload, cutting off VPN access and any traffic passing through the firewall until it comes back up. The issue was found by Eric Fernald during a Cisco TAC support case, and Cisco rates it 8.6 (High) on the CVSS 3.1 scale.

One day after publication, CISA added CVE-2026-76418 to its Known Exploited Vulnerabilities catalog, confirming Cisco's own statement that its Product Security Incident Response Team (PSIRT) "became aware of active exploitation" of the flaw in October 2026. CISA's KEV entry does not report a known ransomware link, but its presence on the list at all means federal agencies, and by extension any organization taking CISA's guidance seriously, should treat this as a live threat rather than a theoretical one.

Who's actually affected

This isn't every ASA or FTD deployment. Cisco's advisory lists three conditions that all have to be true for a device to be vulnerable:

• The running configuration has webvpn enabled with SSL VPN turned on for at least one interface.
• At least one tunnel group — including the default DefaultWEBVPNGroup if the tunnel-group list is disabled or not configured — has secondary-authentication-server-group set. If tunnel-group-list enable is turned on, every visible tunnel group needs checking, not just the default one.
• The SSL remote-access VPN login page is reachable by the attacker, whether from the internet or from wherever the attacker sits on the network.

Cisco has confirmed that its cloud-delivered offerings — Cloud-delivered Firewall, cloud-delivered Firewall Management Center (cdFMC), Secure Access, and Secure Firewall Management Center (FMC) Software — are not affected. The exposure is specific to on-premises ASA and FTD boxes running remote-access VPN with secondary authentication, a common setup for organizations that pair a VPN login with a second factor like a RADIUS or TACACS+ server.

Why a device reload is a bigger deal than it sounds

An unauthenticated denial-of-service bug doesn't hand an attacker code execution or data access on its own, but on a firewall that's exactly the point: ASA and FTD devices typically sit at the network edge, and a forced reload knocks out remote-access VPN for every employee trying to connect, along with any other traffic the device is handling. Repeated or automated triggering could keep a device cycling through reloads, effectively denying VPN access for as long as the attacker keeps sending crafted requests. For organizations that rely on site-to-site or remote-access VPN for a distributed workforce, that's a availability outage with real business impact, not just a log entry.

Affected and fixed releases

How to fix it: patch, or use the workaround

Cisco's recommended remediation is upgrading to one of the fixed releases above for your specific train. There is no workaround that fully closes the hole, but Cisco describes two mitigation options for admins who can't patch immediately, depending on how the default tunnel group is configured:

• If DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel-group list with no tunnel-group-list enable. Users will then need to know their exact connection-profile name to connect, which blocks the default group from being targeted directly but adds friction for end users.
• If DefaultWEBVPNGroup does use secondary authentication, you can remove it with no secondary-authentication-server-group — but Cisco is explicit that this lowers your remote-access VPN security posture, since it drops the second factor.

Neither workaround is a substitute for the patch; both trade one risk for another. Cisco's bottom line is to upgrade to a fixed release as soon as your change window allows, and to use a workaround only as a stopgap.

The CISA deadline and what it means for you

CISA's KEV catalog entry sets a remediation due date of November 1, 2026 for U.S. federal civilian agencies, under Binding Operational Directive 26-04. The directive's required action is to apply Cisco's mitigation or patch, or — if neither is possible — to follow BOD 26-04's cloud-service guidance or stop using the product. CISA's entry does not require forensic triage for this specific CVE, and it lists ransomware use as "Unknown" rather than confirmed. Private-sector organizations aren't bound by the federal deadline, but CISA's own guidance is that the same timeline is a reasonable target for anyone running exposed ASA or FTD VPN gateways.

Is it being exploited against you specifically?

Cisco's advisory states plainly that its PSIRT is aware of active exploitation of this vulnerability, which is the reason it moved straight onto CISA's KEV list the day after publication rather than sitting as a routine advisory. Cisco has not published indicators of compromise or attacker infrastructure details in the advisory text. If your ASA or FTD device has unexpectedly reloaded recently and it matches the vulnerable configuration above, treat that as worth investigating, and check Cisco's advisory page directly for any updates — the current version is 1.0, dated October 28, 2026, and Cisco may revise it as more detail becomes available.

What to do next

Check whether your ASA or FTD deployment matches all three vulnerable conditions — SSL VPN enabled, secondary authentication on a reachable tunnel group — and if so, schedule the upgrade to your train's fixed release immediately, prioritizing any device reachable from the internet. If you can't patch right away, apply one of Cisco's two mitigation options as a stopgap, understanding the tradeoff each one makes. For more on how CISA's exploited-vulnerability deadlines work, see our explainer on how CVE IDs and CVSS scores work, and for another firewall fundamentals primer, see what a firewall actually does. Teams managing VPN access more broadly may also want to read our comparison of consumer VPN services for context on how VPN security models differ.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage