CVE-2026-76418Cisco ASA and FTD SSL VPN denial of service (CVE-2026-76418) exploited in the wild

Executive summary

CVE-2026-76418 is a denial-of-service flaw (CWE-690, unchecked return value to NULL pointer dereference) in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Logic errors when secondary authentication is configured on a tunnel group let an unauthenticated remote attacker send a crafted request during SSL VPN connection and force the device to reload. CVSS 3.1 is 8.6 (availability impact only, scope changed). Cisco states that a successful VPN login is not required to reach the affected code path.

Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 on 2026-10-28 and states that its PSIRT became aware of active exploitation in October 2026. CISA added the CVE to KEV on 2026-10-29 with a due date of 2026-11-01. Cisco has not published attack details, IOCs or attribution.

Fixed releases exist for all supported ASA and FTD trains; there is no full workaround. As a temporary mitigation Cisco describes disabling the tunnel group list or removing secondary authentication, which weakens remote access VPN security.

Threat assessment

Impact is limited to availability: no code execution or data access is described. For organisations relying on ASA/FTD as perimeter firewall and remote access VPN concentrator, however, repeated unauthenticated reloads mean loss of remote access and of perimeter filtering during reboot, and the attack needs no credentials.

This is the second exploited ASA/FTD SSL VPN reload zero-day of 2026: CVE-2026-20349 (insufficient error checking in HTTP request processing, advisory 2026-08-11, KEV 2026-08-11) was also exploited for DoS. SecurityWeek notes it is unclear whether the same actor exploited both. No source opened describes CVE-2026-76418 as part of an exploit chain or named campaign.

Exposure is significant: BleepingComputer cites Shadowserver tracking more than 51,000 internet-exposed Cisco ASA SSL VPN devices (patch state unknown), but only devices with secondary authentication configured in an affected tunnel group are vulnerable. Given the 2025 ArcaneDoor campaign against ASA (CVE-2025-20333, CVE-2025-20362), unexplained ASA/FTD reloads should be reviewed rather than dismissed as stability issues.

Timeline

1. 2026-10-29

   CISA adds CVE-2026-76418 to KEV (due date 2026-11-01). Source

2. 2026-10-28

   Cisco publishes advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 with fixed ASA/FTD releases and confirms active exploitation (aware since October 2026). Source

3. 2026-09-16

   Cisco updates advisory for earlier exploited SSL VPN DoS CVE-2026-20349 (v1.1). Source

4. 2026-08-11

   Cisco discloses CVE-2026-20349, a separate exploited ASA/FTD SSL VPN reload flaw; CISA adds it to KEV the same day. Source

Affected & exposure

Cisco Secure Firewall ASA Software and Secure FTD Software running a vulnerable release, with the SSL VPN (webvpn) login service enabled on at least one interface and secondary authentication (secondary-authentication-server-group) configured on a tunnel group, including DefaultWEBVPNGroup.

If tunnel-group-list is enabled, all tunnel groups count, not only those shown on the login page; if the group list is disabled, DefaultWEBVPNGroup with secondary authentication still exposes the device.

ASA first fixed releases: 9.16 and earlier 9.16.4.104; 9.18 9.18.4.96; 9.20 9.20.4.50; 9.22 9.22.3.200; 9.23 9.23.1.48; 9.24 9.24.1.27 and 9.24.10.1.

FTD first fixed releases: 7.0 and earlier 7.0.11; 7.2 7.2.13; 7.4 7.4.9; 7.6 7.6.7; 7.7 7.7.14; 10.0 10.0.3; 10.1 10.1.1.

Not affected per Cisco: Cloud-delivered Firewall, cdFMC, Cisco Secure Access, Secure Firewall Management Center (FMC) Software.

Exploitation in the wild

Cisco PSIRT became aware of active exploitation in October 2026 (advisory and CVE record).

CISA KEV listing on 2026-10-29; CISA ADP SSVC rates Exploitation active, Automatable yes, Technical Impact partial. KEV marks known ransomware use as Unknown and forensic triage as not required.

The flaw was found during a Cisco TAC support case; Cisco credits Eric Fernald.

Cisco has not disclosed targets, attack volume, start date or threat actor. No public IOCs or crash signatures in the advisory.

No chaining documented: the advisory lists no related advisories, and the earlier DoS advisory for CVE-2026-20349 does not reference CVE-2026-76418.

Detection & hunting

Cisco publishes no IOCs or crash signatures for this flaw, so detection focuses on its documented effect (unexpected reload of ASA/FTD with SSL VPN and secondary authentication enabled) and on exposure. Correlate device reboots, gaps in firewall syslog and VPN availability alarms; then collect crash information from the device and open a TAC case. Field names and syslog sources are generic and need verification against your parsers.

index=network (sourcetype=cisco:asa OR sourcetype=cisco:ftd*)
("reload" OR "Reload" OR "crashinfo" OR "traceback" OR "Traceback" OR "coldStart" OR "Restarted")
| stats count min(_time) as first max(_time) as last values(_raw) as samples by host
| convert ctime(first) ctime(last)

index=network (sourcetype=cisco:asa OR sourcetype=cisco:ftd*)
| sort 0 host _time
| streamstats current=f last(_time) as prev by host
| eval gap_min=round((_time-prev)/60,1)
| where gap_min > 5
| table host prev _time gap_min
| convert ctime(prev) ctime(_time)

// CommonSecurityLog from ASA/FTD via CEF; adapt vendor/product filters
CommonSecurityLog
| where DeviceVendor == "Cisco" and DeviceProduct has_any ("ASA", "Firepower", "FTD")
| where Activity has_any ("WebVPN", "SSL", "AnyConnect", "Secure Client")
| summarize attempts=count(), sources=dcount(SourceIP) by Computer, bin(TimeGenerated, 5m)
| order by Computer asc, TimeGenerated asc

title: Cisco ASA/FTD config exposed to CVE-2026-76418 (exposure audit)
status: experimental
description: Flags configuration backups or config-audit logs showing SSL VPN enabled together with secondary authentication on a tunnel group (precondition per Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75). Not an exploitation detection.
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75
logsource:
  product: cisco_asa
  category: config_audit
detection:
  webvpn:
    - '|contains': 'webvpn'
  secondary:
    - '|contains': 'secondary-authentication-server-group'
  condition: webvpn and secondary
level: medium

Mitigation

• Upgrade ASA and FTD to the first fixed release for your train (see affected list); use the Cisco Software Checker to confirm, FTD upgrades via the Secure FMC upgrade guide.
• Identify exposed devices: webvpn with enable <interface> in the running config (FTD: Devices > VPN > Remote Access in FMC, or Remote Access VPN in FDM) and secondary-authentication-server-group on any tunnel group including DefaultWEBVPNGroup.
• Temporary mitigation only if patching is delayed: if DefaultWEBVPNGroup does not use secondary authentication, run no tunnel-group-list enable in webvpn mode (users must then know the connection profile name); otherwise remove secondary authentication, accepting reduced VPN security. Cisco recommends upgrading instead.
• Treat unexplained reloads of SSL VPN headends since October 2026 as potential exploitation: collect crash information and logs before cleanup and open a Cisco TAC case.
• Also confirm the fix for the earlier exploited SSL VPN DoS CVE-2026-20349 (advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF), which has different preconditions (SSL VPN, IKEv2 client services or ZTNA).
• Federal agencies: follow the CISA KEV required action (BOD 26-04 guidance; due date 2026-11-01).

Update log

Sources

1. Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75
2. CVE-2026-76418 CVE record (CVE Program, cvelistV5)
3. CISA Known Exploited Vulnerabilities catalog (JSON mirror)
4. Cisco Security Advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF (CVE-2026-20349)
5. SecurityWeek: Attackers exploit second Cisco firewall VPN zero-day since August
6. BleepingComputer: Cisco warns of firewall zero-day exploited to crash SSL VPN devices
7. The Hacker News: Cisco patches actively exploited ASA flaw