Cisco patches exploited ASA and FTD SSL VPN flaw that lets attackers reload firewalls

TLDR

• Cisco patched CVE-2026-76418 (CVSS 8.6), a flaw letting unauthenticated attackers force ASA and FTD firewalls to reload.¹²
• Cisco says it became aware of exploitation in October 2026 but has shared no details on attackers or targets.¹²⁴
• Exposure needs a reachable SSL VPN login and secondary authentication on a tunnel group; Cisco lists fixed releases per branch.¹

Cisco has released software updates for CVE-2026-76418, a vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that its advisory rates High with a CVSS base score of 8.6.¹ An unauthenticated, remote attacker could cause the device to reload unexpectedly, resulting in a denial-of-service condition.¹ Cisco attributes the flaw to logic errors when secondary authentication is configured on a tunnel group, and says an attacker could trigger it by sending a crafted request when connecting to the SSL remote access VPN.¹² In the advisory's exploitation section, Cisco says its Product Security Incident Response Team became aware of active exploitation in October 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 29 October.¹⁵

Cisco says a device is affected if it runs a vulnerable release of ASA or FTD software, the SSL remote access VPN login service is reachable, and secondary authentication is configured in the tunnel group scope.¹ It adds that a successful VPN login is not required to reach the affected processing path.¹⁴ Cisco has confirmed that Cloud-delivered Firewall, Cloud-delivered Firewall Management Center, Secure Access and Secure FMC Software are not affected.¹ The advisory gives a first fixed release for each ASA and FTD software branch, and Cisco strongly recommends upgrading.¹

The advisory states that no workarounds address the vulnerability, but describes a mitigation: disable secondary authentication on any user-configured tunnel group or on the default tunnel group, DefaultWEBVPNGroup, or, if the default group does not use secondary authentication, disable the tunnel group list.¹ Cisco warns that removing secondary authentication lowers the security posture of remote access VPN.¹⁴ The Hacker News calls the same steps a temporary mitigation.²

Cisco has not said when the attacks began, who is behind them or how widespread they are, according to The Hacker News and SecurityWeek.²⁴ BleepingComputer reports that Cisco gave no indicators of compromise, and that Shadowserver tracks more than 51,000 Cisco ASA SSL VPN devices exposed online, without data on how many are already secured or are honeypots.³ SecurityWeek describes this as the second ASA and FTD zero-day exploited for denial-of-service attacks since August, when Cisco fixed CVE-2026-20349, and says it is unclear whether the same threat actor is behind both.⁴ Cisco credits Eric Fernald with finding the flaw during the resolution of a Cisco Technical Assistance Center support case.¹

Why it matters: an unauthenticated request can reload exposed firewalls that use secondary authentication on SSL VPN tunnel groups, and Cisco says exploitation is under way, so upgrading is the fix Cisco recommends over a mitigation that weakens VPN authentication.¹⁴