Cisco Patches CVE-2026-76418 as SSL VPN Flaw Crashes ASA and FTD Devices

Cisco has released security updates for a high‑severity zero‑day, CVE-2026-76418, after its Product Security Incident Response Team observed active exploitation in October 2026. The flaw allows unauthenticated remote attackers to trigger unexpected device restarts in Secure Firewall ASA and FTD software, causing denial-of-service and disruption of remote access. Cisco assigned the vulnerability a CVSS score of 8.6 and published its advisory on October 28, 2026. The issue was discovered by Eric Fernald while resolving a Cisco TAC support case.

What the vulnerability does

The flaw stems from logic errors in the Remote Access SSL VPN service when secondary authentication is configured on a tunnel group. An attacker can send a crafted request while connecting to the VPN service and reach a processing path that causes the device to reload; a successful VPN login is not required to exploit the vulnerability. Cisco’s advisory confirms the impact is a denial-of-service condition that restarts affected devices and disrupts services. The advisory reports no confirmed data theft or remote code execution and does not identify specific attackers or victims.

Technical scope and related vulnerabilities

CVE-2026-76418 is distinct from other recent Cisco firewall issues, including crash attacks tied to CVE-2026-20349 and the earlier ASA zero-day code execution vulnerability CVE-2025-20333. Those flaws have different causes and should not be conflated. Exposure to CVE-2026-76418 requires:

• Running vulnerable ASA or FTD software
• A reachable SSL remote access VPN login service (webvpn)
• A tunnel group configured with secondary authentication

Who is affected and how to check

Administrators should verify whether webvpn is enabled on any interface and inspect tunnel-group configurations for secondary-authentication-server-group settings. When tunnel-group-list enable is configured, checks must include all tunnel groups—this includes the DefaultWEBVPNGroup—not only the profiles shown on the login page. Simply removing the group list does not remove exposure if the default group still has secondary authentication enabled. Cisco notes that Secure FMC, Cloud‑delivered Firewall, cloud‑delivered FMC, and Secure Access products are not affected by this issue.

Fixes and mitigations provided by Cisco

Cisco lists no full workaround but provides temporary mitigation guidance based on tunnel group settings. In some cases, turning off the tunnel-group list can reduce exposure when the default group does not use secondary authentication. Cisco warns that removing secondary authentication altogether lowers VPN security and requires careful review before implementation. Cisco strongly recommends applying the provided patches and using its Software Checker to determine exposed releases and identify suitable fixed software for each branch before upgrading.

Fixed releases called out by Cisco

• Fixed ASA releases include 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, and 9.23.1.48. Cisco also lists 9.24.1.27 and 9.24.10.1.
• Fixed FTD releases include 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1.

Practical steps for security teams

• Inventory: Confirm which ASA and FTD devices expose an SSL remote access VPN login service and whether those tunnel groups use secondary authentication.
• Patch: Prioritize testing and deployment of the fixed releases matched to each device’s software branch, using Cisco’s Software Checker to guide selection.
• Mitigate carefully: If temporary configuration changes are considered (for example, disabling tunnel-group lists), validate that those changes do not inadvertently leave a default group with secondary authentication enabled or otherwise reduce security.
• Alerting and intel: Give SOC teams the alert context they need to stop incidents quickly and integrate threat intelligence feeds to correlate any suspicious access attempts with broader activity.

Why this matters

The vulnerability illustrates that logic errors in authentication-related paths can have outsized impact even when they do not yield data theft or code execution. For organizations relying on remote access VPNs, a forced device restart can abruptly sever critical connectivity for remote workers and contribute to operational disruption. Cisco’s advisory and the provided fixed releases give administrators a clear path to mitigate the risk, but timely detection and patching remain essential.