# Cisco ASA and FTD VPN crash bug CVE-2026-76418 is being exploited: check for secondary authentication, then patch

> Attackers are using a flaw in Cisco's Secure Firewall remote-access SSL VPN to reboot firewalls without logging in. Only devices with secondary authentication on a tunnel group are exposed, so a two-minute config check tells you how urgent this is.

Published Nov 2, 2026 by TechMeasured Staff · Security · Canonical: https://techmeasured.com/security/cisco-asa-ftd-cve-2026-76418-ssl-vpn-dos-exploited

Cisco says attackers are actively exploiting **CVE-2026-76418**, a flaw in the remote-access SSL VPN of its Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software that lets an unauthenticated attacker force the firewall to reload. Cisco published the advisory on October 28 and rates it High, CVSS 8.6. CISA added the bug to its Known Exploited Vulnerabilities catalog the next day, with a November 1 deadline for federal agencies, according to The Hacker News. (The same KEV update added a GitLab flaw we [covered separately](/security/gitlab-onigmo-regex-rce-exploited-patch-ruby).)

Why it matters: this is "only" a denial of service, but the device that falls over is the perimeter firewall and the VPN everyone uses to get in. Repeated crashes mean outages, and Cisco notes that a successful VPN login is not needed to reach the vulnerable code. BleepingComputer, citing Shadowserver, reports more than 51,000 Cisco ASA SSL VPN devices visible online, though not how many are vulnerable.

## What's wrong

Cisco attributes the bug to logic errors that arise when **secondary authentication** is set on a tunnel group (connection profile). An attacker sends a crafted request while connecting to the SSL VPN, and the device reloads. The advisory classifies it as CWE-690, an unchecked return value leading to a NULL pointer dereference; the Cisco bug ID is CSCwx26625.

Cisco says its PSIRT learned of exploitation in October 2026. Neither Cisco nor the reports we read name the attackers, say how many organizations were hit, or publish indicators of compromise. Cisco credits Eric Fernald with finding the flaw while working a TAC support case.

## Are you exposed?

According to Cisco, a device is vulnerable only if **all three** are true:

1. It runs an affected ASA or FTD release.
2. The SSL remote-access VPN login service is reachable — the running config contains `webvpn` and SSL VPN is enabled on at least one interface.
3. At least one tunnel group has `secondary-authentication-server-group` configured.

How to check the third point depends on your setup:

- **If `tunnel-group-list enable` is configured**, look at every tunnel group, including `DefaultWEBVPNGroup` and groups that don't appear on the login page.
- **If the list is not enabled**, check `DefaultWEBVPNGroup`. Cisco stresses that turning the list off does not help if the default group itself uses secondary authentication.

In practice, that means searching the running config for these keywords:

```
webvpn
tunnel-group-list enable
secondary-authentication-server-group
```

On FTD, review the remote-access VPN policy in Secure Firewall Management Center (Devices > VPN > Remote Access) or in Device Manager.

Cisco lists Cloud-delivered Firewall, cloud-delivered FMC, Secure Access and Secure FMC software as **not affected**.

## Fixed releases

| ASA train | First fixed | FTD train | First fixed |
|---|---|---|---|
| 9.16 and earlier | 9.16.4.104 | 7.0 and earlier | 7.0.11 |
| 9.18 | 9.18.4.96 | 7.2 | 7.2.13 |
| 9.20 | 9.20.4.50 | 7.4 | 7.4.9 |
| 9.22 | 9.22.3.200 | 7.6 | 7.6.7 |
| 9.23 | 9.23.1.48 | 7.7 | 7.7.14 |
| 9.24 | 9.24.1.27 and 9.24.10.1 | 10.0 | 10.0.3 |
| | | 10.1 | 10.1.1 |

Source: Cisco's advisory.

## What to do

**1. Run the config check above today.** If no tunnel group uses secondary authentication, you aren't exposed to this bug. Schedule the upgrade anyway.

**2. If you are exposed, upgrade to a fixed release.** Cisco says no workaround fully addresses the issue and strongly recommends upgrading. Treat it as an emergency change: exploitation is confirmed and the trigger needs no credentials.

**3. If you can't upgrade immediately, use Cisco's temporary mitigations:**

- If `DefaultWEBVPNGroup` does **not** use secondary authentication, run `no tunnel-group-list enable` in WebVPN configuration mode. Users then have to know their connection profile name, since the drop-down list disappears.
- If `DefaultWEBVPNGroup` **does** use secondary authentication, remove it with `no secondary-authentication-server-group`. Cisco warns this weakens VPN authentication, so treat it as a stopgap.

**4. Watch for unexpected reloads.** Crashes or reboots of an ASA or FTD with the SSL VPN enabled since early October deserve a closer look and a TAC case, given that Cisco has published no indicators of compromise.

**5. Keep the pattern in mind.** BleepingComputer notes this is not the first ASA/FTD zero-day this year: Cisco patched another exploited DoS, CVE-2026-20349, in August. Internet-facing VPN gateways keep drawing attackers, so they belong at the front of the patch queue.


## Sources

1. [Cisco — Cisco Secure Firewall ASA and FTD Remote Access SSL VPN Tunnel Denial of Service Vulnerability (cisco-sa-asaftd-tunnel-dos-s6mgkb75)](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-asaftd-tunnel-dos-s6mgkb75.html)
2. [BleepingComputer — Cisco warns of firewall zero-day exploited to crash SSL VPN devices](https://bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices)
3. [The Hacker News — Cisco patches actively exploited ASA and FTD flaw](https://thehackernews.com/2026/10/cisco-patches-actively-exploited-asa.html)
4. [The Hacker News — CISA adds actively exploited GitLab RCE and Cisco firewall DoS flaws to KEV](https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html)