CVE-2026-76418: Cisco Secure Firewall ASA and FTD SSL VPN denial of service

CVE-2026-76418 · Severity: critical · CVSS 8.6 · Exploited in the wild · Published 2026-10-28

Cisco's firewall products (Secure Firewall ASA and FTD) that provide remote access VPN services contain a vulnerability in how they handle secondary authentication configuration. An unauthenticated attacker on the network can send a crafted request to the VPN login service to crash the firewall, temporarily taking it offline and blocking all network traffic. This requires the firewall to have SSL VPN enabled and secondary authentication configured.

Technologies: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall ASA Software, Cisco Secure Firewall Threat Defense (FTD) Software. Vendors: Cisco.

Quick answers

Is CVE-2026-76418 exploited in the wild?
Yes. CVE-2026-76418 is known to be exploited in the wild, first recorded on 29 October 2026. Treat it as urgent.
How severe is CVE-2026-76418?
Critical severity, with a CVSS score of 8.6, published 28 October 2026.
Which products and versions are affected?
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software; Cisco Secure Firewall Threat Defense (FTD) Software.
Is there a fix for CVE-2026-76418?
No fixed version is recorded yet. Disable secondary authentication on any user-configured tunnel group or on the default tunnel group (DefaultWEBVPNGroup) using the CLI command `no secondary-authentication-server-group`, or disable the tunnel-group list entirely with `no tunnel-group-list enable` if the default group does not use secondary authentication. Note that disabling secondary authentication lowers the security posture of remote access VPN. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76418 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-76418?
Check whether you run Cisco Secure Ftd Software, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall ASA Software or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable secondary authentication on any user-configured tunnel group or on the default tunnel group (DefaultWEBVPNGroup) using the CLI command `no secondary-authentication-server-group`, or disable the tunnel-group list entirely with `no tunnel-group-list enable` if the default group does not use secondary authentication. Note that disabling secondary authentication lowers the security posture of remote access VPN.

Technical details

The vulnerability stems from logic errors in the Remote Access SSL VPN service when secondary authentication is configured on a tunnel group. An unauthenticated, remote attacker can exploit this by sending a crafted request during SSL VPN connection, triggering an unexpected device reload. No successful exploit in the wild has been reported; mitigation by disabling secondary authentication on the tunnel group is available pending patched software.

Affected products

  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
  • Cisco Secure Firewall Threat Defense (FTD) Software

Timeline

  • 2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.