Last updated: 29 October 2026. Cisco published its advisory on 28 October.
Cisco says attackers are exploiting CVE-2026-76418 in Secure Firewall ASA and Threat Defense software. An unauthenticated remote attacker can force an affected device to reload, causing denial of service. This advisory describes an availability attack, not remote code execution.
The flaw concerns SSL remote access VPN with secondary authentication in a tunnel group. A successful VPN login is not required. Cisco rates it High, 8.6 under CVSS 3.1. Our CVE-2026-76418 technical profile keeps the affected scope and lifecycle facts together.
Choose the Fixed Release for Your Track
The Cisco security advisory lists these first fixed releases. Read each row within its own software track. A number from another branch is not a substitute for checking the deployed product. The two fixed builds shown for ASA 9.24 belong to the options Cisco lists.
| Software | Release Track | First Fixed Release |
|---|---|---|
| ASA | 9.16 and earlier | 9.16.4.104 |
| ASA | 9.18 | 9.18.4.96 |
| ASA | 9.20 | 9.20.4.50 |
| ASA | 9.22 | 9.22.3.200 |
| ASA | 9.23 | 9.23.1.48 |
| ASA | 9.24 | 9.24.1.27 or 9.24.10.1 |
| FTD | 7.0 and earlier | 7.0.11 |
| FTD | 7.2 | 7.2.13 |
| FTD | 7.4 | 7.4.9 |
| FTD | 7.6 | 7.6.7 |
| FTD | 7.7 | 7.7.14 |
| FTD | 10.0 | 10.0.3 |
| FTD | 10.1 | 10.1.1 |
Use Cisco’s linked Software Checker and upgrade guidance to select an appropriate release for the platform. Keep the current version, chosen fixed build, and rollout result in the patch record. The table is a fix reference, not a claim that every appliance can take every listed build.
Check More Than the Login Page’s Group List
First check whether the SSL remote access VPN login service is reachable. Cisco’s configuration example contains webvpn with enable interface_name. For FTD, review Devices > VPN > Remote Access in Firewall Management Center, or Remote Access VPN in Device Manager.
Then inspect secondary-authentication-server-group. If tunnel-group-list enable is set, check all tunnel groups, including DefaultWEBVPNGroup. Do not limit the review to profiles displayed on the login page. Cisco explicitly calls out the default group as part of the exposure check.
If the group list is disabled, still inspect DefaultWEBVPNGroup. That setting does not remove exposure when the default group uses secondary authentication. Record the deployed configuration on FTD as well as the intended policy. This helps the team assess the actual path rather than a version string alone.
That vendor statement is the reason to act; this report does not infer attacks from social attention. The fetched CISA KEV catalog, dated October 28 and checked October 29, did not list this CVE. A catalog check does not cancel Cisco’s direct exploitation warning.
Treat the Mitigation as a Security Change
Cisco says no workaround addresses the vulnerability. It separately documents a temporary mitigation tied to the tunnel-group setup. If the default group does not use secondary authentication, disabling the group list changes how users choose profiles. If it does, removing secondary authentication lowers remote access VPN security.
Do not apply either case as a blanket instruction to weaken authentication. Cisco tells customers to assess the effect in their own environment and strongly recommends fixed software. This article reports Cisco’s tested mitigation; we did not run an appliance or exploit test.
Start with reachable devices that meet both configuration conditions. Plan the appropriate upgrade, verify the running build after rollout, and recheck the deployed VPN policy. Our patch management entry explains why installation and verification are separate steps. Keep the security and remote access teams involved until that evidence is recorded.