Cisco Secure Firewall Vulnerability Exploited in the Wild to Crash SSL VPN Devices
Do Son 
TL;DR
Cisco disclosed a high-severity Cisco Secure Firewall vulnerability (CVE-2026-76418) on October 28, 2026. This flaw is actively exploited in the wild. The flaw affects Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software. It allows unauthenticated attackers to trigger unexpected device reloads via the SSL VPN service. Therefore, network administrators must apply the latest software updates or configure mitigations immediately.
- CVE: CVE-2026-76418
- CVSS: 8.6 (High · CVSSv3)
- Product: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
- Affected: 9.16.1, 9.16.1.28, 9.16.2, 9.16.2.3, 9.16.2.7, 9.16.2.11 (+203 more)
- Impact: Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
- Status: Exploited in the wild
- Action: See vendor advisory
Why It Matters
Cisco ASA and FTD appliances serve as core perimeter firewalls and VPN gateways for tens of thousands of enterprise networks worldwide. However, exact affected deployment counts are not specified in the advisory. Researcher Eric Fernald discovered the bug (tracked as CSCwx26625 with an 8.6 CVSS v3.1 score) while resolving a Cisco TAC support case.
According to the official Cisco security advisory, “In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” Although no public proof-of-concept exploit code has been released, active exploitation in the wild threatens enterprise remote access availability.
How the Attack Works
The flaw resides in the Remote Access SSL VPN service when secondary authentication is enabled on a tunnel group. In its advisory, Cisco states that “This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN.”
Pre-Authentication Device Reload
Importantly, the advisory notes that “A successful VPN login is not required to reach the affected processing path.” Consequently, an unauthenticated remote attacker can send crafted connection requests to force the firewall to reload. This causes a persistent denial-of-service (DoS) condition. Devices are exposed if the webvpn keyword is enabled on at least one interface. In addition, secondary-authentication-server-group must be configured on any tunnel group or on DefaultWEBVPNGroup.
Affected Versions
This Cisco Secure Firewall vulnerability affects Cisco ASA Software releases 9.16 through 9.24. It also affects Cisco FTD Software releases 7.0 through 10.1 when configured with SSL VPN secondary authentication. Cloud-delivered Firewall (CDFW), cdFMC, Secure Access (CSA), and Secure FMC Software are not affected.
Patch and Mitigation Steps
Cisco resolved CVE-2026-76418 in ASA versions 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, and 9.24.10.1. The issue was also resolved in FTD versions 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1.
While no complete workarounds exist, Cisco notes that “there is a mitigation, which is to disable secondary authentication on any user-configured tunnel group list or on the default tunnel group, DefaultWEBVPNGroup.” Administrators can run no tunnel-group-list enable if DefaultWEBVPNGroup does not use secondary authentication. Otherwise, they can run no secondary-authentication-server-group to remove it until patching is complete.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
