CVE-2026-76418 (CVSS 8.6) hits Cisco ASA and FTD SSL VPN and is on CISA's KEV list. Check if you are affected, and what to patch or mitigate now.
Firewalls at the edge of a corporate network also handle the VPN connections of remote users. If that entry point goes down, staff cannot get in. A new flaw in Cisco’s ASA and FTD firewalls sits exactly there.
Short answer: CVE-2026-76418 is a denial-of-service (DoS) flaw in Cisco Secure Firewall ASA and Cisco Secure FTD software. Devices that use remote access SSL VPN and have secondary authentication set on a tunnel group are affected. An unauthenticated attacker can make the device reload unexpectedly, but the flaw does not allow code execution. It has a CVSS score of 8.6 (high), and Cisco says it has seen active exploitation. Update to a fixed release, and if you cannot, apply the temporary mitigation in the advisory.
What happened?
The flaw appears when a tunnel group on the device has secondary authentication configured. Cisco describes it as a logic error. An attacker sends a crafted request while connecting to the SSL VPN, and the device reloads.
The weakness type is CWE-690, “Unchecked Return Value to NULL Pointer Dereference.” In plain terms, a function can return an empty (NULL) result, the code uses that result without checking it, and the program crashes. Here, the crash makes the device reload.
NVD published the record on October 28, 2026. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 29, 2026. Cisco also said in October 2026 that its PSIRT had become aware of active exploitation. The flaw is new, so no “old flaw” note applies. The KEV entry lists whether it has been used in ransomware campaigns as “Unknown,” which means it is not known.
Who is affected?
| Attribute | Details |
|---|---|
| CVE ID | CVE-2026-76418 |
| Products | Cisco Secure Firewall ASA and Cisco Secure FTD software |
| Affected configuration | SSL VPN enabled on an interface, and secondary-authentication-server-group set on at least one tunnel group (including the default DefaultWEBVPNGroup) |
| CVSS | 8.6 (CVSS 3.1, vector: AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) |
| Severity | High |
| Weakness type | CWE-690 |
| NVD published | October 28, 2026 |
| Added to CISA KEV | October 29, 2026 |
| CISA due date | November 1, 2026 (now past) |
| First fixed ASA releases | 9.16 and earlier: 9.16.4.104; 9.18: 9.18.4.96; 9.20: 9.20.4.50; 9.22: 9.22.3.200; 9.23: 9.23.1.48; 9.24: 9.24.1.27 and 9.24.10.1 |
| First fixed FTD releases | 7.0 and earlier: 7.0.11; 7.2: 7.2.13; 7.4: 7.4.9; 7.6: 7.6.7; 7.7: 7.7.14; 10.0: 10.0.3; 10.1: 10.1.1 |
The advisory summary lists only the first fixed release for each branch. Check the full affected version ranges in Cisco’s advisory before you plan the upgrade.
Cisco says Cloud-delivered Firewall (CDFW), cdFMC, Secure Access, and Secure FMC Software are not affected.
What should you do?
- Check whether SSL VPN is enabled. On ASA, run
show running-config webvpnand look for thewebvpnsection and anenableline on an interface. On FTD, review the remote access VPN policy in FMC or FDM. - Check the tunnel groups. On ASA, run
show running-config tunnel-groupand look forsecondary-authentication-server-group. Include the default DefaultWEBVPNGroup. - Find your version. On ASA,
show versionprints the software version. Compare it with the table above. - Upgrade to a fixed release. Schedule a maintenance window and back up the configuration first.
- If you cannot upgrade yet, apply the temporary mitigation. The advisory describes two cases. If DefaultWEBVPNGroup does not use secondary authentication, run
no tunnel-group-list enablein WebVPN configuration mode. If it does, runno secondary-authentication-server-group, but this lowers the security of your remote access VPN. Cisco calls both measures temporary and says there is no workaround that fixes the flaw. - If in doubt, open a support case. If the device reloads unexpectedly, open a case with Cisco TAC and keep following the advisory.
Frequently asked questions
Does this affect me?
You are affected if you run Cisco ASA or FTD software with remote access SSL VPN and secondary authentication on a tunnel group. The two checks above will tell you. Cloud-delivered Firewall, cdFMC, Secure Access, and Secure FMC are not affected.
The CVSS is 8.6, but there is no code execution. Is it still urgent?
Yes. No authentication is needed to trigger the flaw, and its impact on availability is high. Code execution is not the only thing that matters: an attacker who can take down your VPN gateway can cut off remote access for everyone. The KEV listing and the reported exploitation make it a priority.
What if I cannot update right away?
Apply the mitigation in the advisory, but remember it is temporary and does not replace an upgrade. Removing secondary authentication lowers VPN security, so plan the upgrade with a firm date.
Sources
- NVD record: https://nvd.nist.gov/vuln/detail/CVE-2026-76418
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Cisco security advisory (cisco-sa-asaftd-tunnel-dos-s6mgkb75): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75
This article was prepared on November 6, 2026, based on the CISA and NVD records. It will be updated if new information appears. For server and application updates or security maintenance, you can reach me through the quote form.