Update Cisco ASA and FTD: attackers exploit CVE-2026-76418 to crash VPN firewalls

Timing: Cisco disclosed the flaw and published fixed releases on 28 October 2026. CISA added it to KEV on 29 October, with a federal due date of 1 November. We publish on 31 October, three days after the fix.

What happened

An attacker with no credentials can make a Cisco ASA or FTD firewall reload. The attack targets the SSL remote-access VPN. Each reload cuts off VPN users and traffic through the device. Repeated attacks can keep it down.

Cisco says it became aware of active exploitation in October 2026. The bug, CVE-2026-76418, was found while Cisco support worked a customer case.

Who is affected

Cisco Secure Firewall ASA and FTD software with SSL remote-access VPN enabled and secondary authentication set on a tunnel group. A successful VPN login is not required.

If the tunnel group list is enabled, check every tunnel group. If it is disabled, DefaultWEBVPNGroup is what counts. Cloud-Delivered Firewall, cdFMC, Secure Access and Secure FMC are not affected.

What is confirmed

• Severity. Cisco rates it High, CVSS 8.6. The impact is availability only. Cisco does not say data is exposed.
• Exploitation. Cisco confirms attacks in the wild. CISA lists it in KEV since 29 October, due 1 November. Ransomware use is unknown.
• The fix. ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1. FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1.
• No workaround. Cisco offers configuration mitigations only, listed below.

What is not confirmed

• Cisco has not said who is attacking, how widely, or since when. We do not know if attacks started before the fix.
• Cisco does not link this flaw to any code execution or data theft. Treat it as a crash bug unless that changes.
• We found no public PoC on GitHub on 31 October 2026. NVD has no score of its own yet.

What to do

1. Check exposure. Confirm whether SSL VPN is on and any tunnel group uses secondary authentication. Include DefaultWEBVPNGroup. (ThreatWire advice.)
2. Upgrade to a fixed ASA or FTD release above. (Cisco guidance.)
3. Use a stopgap if you cannot upgrade yet. If DefaultWEBVPNGroup has no secondary authentication, disable the tunnel group list. Otherwise, Cisco says you can remove secondary authentication from DefaultWEBVPNGroup. That weakens VPN security, so weigh it carefully. (Cisco guidance.)
4. Watch for unexpected reloads and crash files on VPN firewalls. Open a Cisco support case if you see them. (ThreatWire advice.)

Sources

Cisco security advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75, published 28 October 2026. CISA's Known Exploited Vulnerabilities catalog. The CVE.org and NVD records for CVE-2026-76418.

Record: CVE-2026-76418