CVE-2026-76418
Cisco ASA and FTD SSL VPN flaw lets unauthenticated attackers reload the firewall (CVE-2026-76418)
An unauthenticated, remote attacker can make Cisco ASA or FTD reload by sending crafted traffic to the SSL remote-access VPN, causing a denial of service. Only devices with secondary authentication on a tunnel group are affected. Cisco rates it High, CVSS 8.6, and says it is exploited. Fixed on 28 October 2026. CISA added it to KEV on 29 October, due 1 November.
By ThreatWire Desk · Published 28 Oct 2026 · Updated 31 Oct 2026
- CVSS
- 8.6
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- Class
- DoS
- Status
- Active Exploitation
- KEV
- Listed in CISA KEV
- 0-day
- No
- Vendor
- Cisco
- Products
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software
- Affected
- ASA and FTD releases before the fixed builds below, when SSL remote-access VPN is enabled and secondary authentication is configured on a tunnel group. If the tunnel group list is disabled, the DefaultWEBVPNGroup settings decide exposure. A successful VPN login is not needed.
- Fixed
- ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1. FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. Not affected: Cloud-Delivered Firewall, cdFMC, Secure Access and Secure FMC.
- CWE
- CWE-690
- Published
- 28 Oct 2026
- Updated
- 31 Oct 2026
The status above is the claim. Links do not upgrade it.
CVE-2026-76418 lets an unauthenticated, remote attacker make a Cisco ASA or FTD firewall reload. The attack goes through the SSL remote-access VPN. Every reload drops VPN users and traffic through the device.
Affected: ASA and FTD with SSL remote-access VPN enabled and secondary authentication on a tunnel group. If the tunnel group list is enabled, check every tunnel group. If it is disabled, check DefaultWEBVPNGroup. The attacker does not need a valid VPN login.
Fixed: ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1. FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. Cloud-Delivered Firewall, cdFMC, Secure Access and Secure FMC are not affected.
Timeline: Cisco published the advisory and fixed releases on 28 October 2026 at 19:15 GMT. It says it learned of active exploitation in October 2026. It does not say whether attacks began before the fixes. CISA added the CVE to KEV on 29 October, a day after disclosure. The federal due date is 1 November. CISA marks ransomware use as unknown and does not flag it for forensic triage.
Severity: Cisco rates it High, CVSS 8.6. NVD has no score of its own yet. The weakness is an unchecked return value that leads to a NULL pointer dereference (CWE-690).
PoC status: we found no public PoC on GitHub on 31 October 2026.
What to do: upgrade to a fixed release. Cisco lists no workaround. As a stopgap, Cisco suggests disabling the tunnel group list when DefaultWEBVPNGroup has no secondary authentication, or removing secondary authentication from DefaultWEBVPNGroup. The second option weakens VPN security. Our story covers the checks.