Cisco Firewall VPN Bug Is Being Used to Knock ASA and FTD Offline
Cisco says attackers are exploiting CVE-2026-76418, an unauthenticated bug in the ASA and FTD SSL VPN that forces the firewall to reboot when secondary authentication is configured.
Cisco has patched a flaw in the SSL VPN of its ASA and Firepower Threat Defense (FTD) firewalls that attackers are already using to make the devices reboot. In an Oct. 28 advisory, Cisco says it learned of active exploitation of CVE-2026-76418 this month, The Hacker News reports. No login is needed: a crafted request to the VPN login service is enough to knock the firewall offline.
For defenders
The bug: CVE-2026-76418, CVSS 8.6, is a logic error in the Remote Access SSL VPN service that shows up when secondary authentication is configured on a tunnel group. An unauthenticated remote attacker can force a reload, T1499.004 (Endpoint Denial of Service: Application or System Exploitation). It’s a denial-of-service bug, not code execution. Cisco hasn’t said when the attacks started, who is behind them or how widespread they are. No public exploit code is reported, and it isn’t in CISA’s KEV catalog yet.
You’re exposed if all three are true: you run a vulnerable ASA or FTD release, the SSL remote access VPN login is reachable, and any tunnel group, including DefaultWEBVPNGroup, uses secondary authentication. Cisco notes an attacker doesn’t need a successful VPN login to reach the vulnerable code.
Fixed releases: ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1. FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1.
Until you patch: Cisco’s workaround is to turn off secondary authentication on the affected tunnel groups, or to disable the tunnel group list if the default group doesn’t use it. Disabling the list alone doesn’t help if DefaultWEBVPNGroup itself uses secondary authentication, so check every group. On FTD, check the deployed remote access VPN policy in Secure FMC or FDM. Cisco firewalls have been a steady target this year; Cisco Talos this week also tied an SD-WAN key-stealing campaign to infrastructure used by China’s Volt Typhoon.
What it means for you
If your business connects staff to the office through a Cisco firewall VPN, someone on the internet can now crash that firewall on demand. Nobody gets your data from this bug, but every crash cuts off remote workers and anything else that runs through the firewall until it comes back up. If an IT provider runs your network, ask them whether this is patched.
Do this now
- Upgrade Cisco ASA or FTD to the fixed release for your version listed above.
- If you can’t upgrade today, check every VPN tunnel group for secondary authentication and apply Cisco’s workaround.
- Watch for unexpected firewall reloads and crash files, and treat them as a sign of attack.
CVE at a glance
- CVSS
- 8.6 High (v3.1)
- EPSS
- 0.6% chance of exploitation in the next 30 days (higher than 47.3% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Oct 29, 2026
- Public exploit
- None reported in public exploit databases
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.