Article
Cisco ASA/FTD VPN DoS: Patch the Exploited Tunnel Flaw
Patch CVE-2026-76418 in Cisco ASA and FTD. Check SSL VPN and tunnel-group settings, find fixed releases, and assess the mitigation trade-off.
Read more
Exploited vulnerability
CVE-2026-76418
A denial-of-service flaw in Cisco Secure Firewall ASA and Threat Defense (FTD).
- CVE ID
- CVE-2026-76418
- CVSS
- 8.6 High (CVSS 3.1, Cisco)
- Affected product
- Secure Firewall ASA and Threat Defense (FTD)
- Exploited
- October 2026
- Published
- 28 October 2026
In short
CVE-2026-76418 is a denial-of-service flaw in Cisco Secure Firewall ASA and Threat Defense (FTD). It affects SSL remote access VPN. A remote attacker needs no login to make an affected device reload. Cisco rates it 8.6 High under CVSS 3.1 and confirmed active exploitation in October 2026.
- CVECVE-2026-76418
- ProductCisco Secure Firewall ASA and Threat Defense (FTD)
- ExploitedYesin real attacks
- Fix Steps4actions listed
What it allows
The flaw can stop the Remote Access SSL VPN service. Cisco links it to logic errors when a tunnel group uses secondary authentication. An attacker can send a crafted connection request to make the device reload. A successful VPN login is not required.
The Cisco CNA assigns CWE-690: an unchecked return value that leads to a NULL pointer dereference. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.
That vector gives a High impact on service availability. It gives no impact on data secrecy or integrity. Cisco describes denial of service, not remote code execution.
Cisco PSIRT became aware of active exploitation in October 2026. The advisory appeared on October 28. It gives no exact day when attacks began. It names no attacker and gives no victim count.
The fetched CISA KEV catalog is dated October 28. It did not list this CVE when checked on October 29. That dated check does not cancel Cisco's direct warning that attackers are using the flaw.
Who is affected
The device must run an affected ASA or FTD release. Its SSL remote access VPN login service must be reachable. The relevant tunnel group must also use secondary authentication. Look for webvpn with SSL VPN enabled on an interface.
If tunnel-group-list enable is set, check every tunnel group for secondary-authentication-server-group. Include DefaultWEBVPNGroup. Check more than the profiles shown on the login page.
If the group list is absent or disabled, still check the default group. It can remain exposed when it uses secondary authentication.
For FTD, check the deployed remote access VPN policy and running setup. Use Firewall Management Center or Device Manager.
Cisco lists FMC itself and cloud-delivered FMC as not affected. It also lists Cloud-delivered Firewall and Secure Access as not affected. A managed firewall and its manager are distinct products.
ASA first fixed builds are 9.16.4.104 for 9.16 and earlier, and 9.18.4.96 for 9.18. Use 9.20.4.50 for 9.20, 9.22.3.200 for 9.22, and 9.23.1.48 for 9.23. For ASA 9.24, Cisco lists 9.24.1.27 or 9.24.10.1.
FTD first fixed builds are 7.0.11 for 7.0 and earlier, 7.2.13 for 7.2, and 7.4.9 for 7.4. Use 7.6.7 for 7.6 and 7.7.14 for 7.7. Use 10.0.3 for 10.0 and 10.1.1 for 10.1. Check Cisco's advisory and Software Checker for a build that suits the platform.
Use our Cisco ASA and FTD VPN DoS patch alert for the release table and setup checks. The patch management entry covers how to check a rollout. The vulnerability management entry explains how exposure and source evidence guide the risk decision.
Timeline
- October 2026
Cisco PSIRT becomes aware of active exploitation; the advisory gives no exact start day.
- 28 Oct 2026
Cisco publishes advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 and the CNA record for CVE-2026-76418.
- 29 Oct 2026
This reference checks vendor conditions, fixed release tracks, and the fetched CISA KEV catalog.
What to do
-
Find Reachable SSL VPN Services
Find ASA and FTD devices with reachable SSL remote access VPN. Record the product, running release, and enabled interface. Then check whether the advisory applies.
-
Inspect Every Relevant Tunnel Group
Check secondary-authentication-server-group in all groups when the group list is enabled. Always include DefaultWEBVPNGroup. Hiding the group list is not enough when the default group uses secondary authentication.
-
Upgrade on the Correct Release Track
Use the first fixed release for the deployed ASA or FTD track, or a later fixed build confirmed by Cisco. Check that the platform supports it. Plan the rollout, then check the running build.
-
Assess Temporary Mitigation Separately
Cisco documents a setup-specific mitigation and says there is no workaround. Removing secondary authentication lowers security. Disabling the group list changes profile selection. Assess each change with the remote access owner and choose fixed software when possible.
Questions
Is CVE-2026-76418 a remote code execution flaw?
Cisco describes unauthenticated remote denial of service through an unexpected device reload. Its CVSS 3.1 score is 8.6 High. The advisory does not describe remote code execution.
Does hiding the tunnel group list remove exposure?
Not when DefaultWEBVPNGroup uses secondary authentication. Cisco says to check that default group even when tunnel-group-list enable is absent or disabled.
Should secondary authentication be disabled on every VPN?
No. Cisco describes configuration-specific temporary mitigation and warns that removing secondary authentication lowers security. Assess the effect in the deployed environment and prioritize fixed software.
In our research
- Cisco ASA/FTD VPN DoS: Patch the Exploited Tunnel Flaw October 2026
- Patch management Glossary term
Sources
- ASA and FTD SSL VPN Tunnel DoS Advisory Cisco PSIRT
- CVE-2026-76418 Record CVE Program / Cisco CNA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 52 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 59 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 99 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.