Cisco has released fixes for a high-severity flaw in its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software, and says attackers are already using it. The flaw, CVE-2026-76418, lets someone with no login send a crafted request to the firewall’s SSL remote access VPN and make the device reload unexpectedly. A firewall that keeps rebooting cuts off every remote worker who depends on it. The Hacker News reports a CVSS score of 8.6.
Cisco’s advisory says its Product Security Incident Response Team learned of active exploitation in October 2026. It has not said who is behind the attacks, when they began, or how widely they have been used, and BleepingComputer notes that Cisco published no indicators of compromise. The bug comes from logic errors when secondary authentication (a second login step such as a separate server check) is set up on a tunnel group. Cisco adds that a successful VPN login is not needed to reach the affected code path. BleepingComputer, citing Shadowserver, says more than 51,000 Cisco ASA SSL VPN devices are exposed on the Internet, though that count does not show how many are patched or are honeypots.
This is not the first Cisco firewall denial-of-service bug exploited this year: BleepingComputer recalls CVE-2026-20349, another ASA and FTD flaw used to crash devices, which Cisco addressed in August. We also covered the exploited Cisco Secure Email Gateway zero-day CVE-2026-76519 earlier this month.
How to check if you’re affected
Affected products are Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, but only when all three of Cisco’s conditions are met: the release is a vulnerable one, the SSL remote access VPN login service is reachable, and secondary authentication is configured in a tunnel group.
- Check your software version against the first fixed releases listed by The Hacker News from Cisco’s advisory. ASA: 9.16.4.104 (for 9.16 and earlier), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1. FTD: 7.0.11 (for 7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. Confirm the table against Cisco’s advisory before upgrading.
- On ASA, look at the WebVPN configuration. If
tunnel-group-list enableis configured, check every tunnel group, including the defaultDefaultWEBVPNGroup, forsecondary-authentication-server-group. If it is absent or has been removed, still checkDefaultWEBVPNGroup, because disabling the group list does not remove exposure when the default group uses secondary authentication. - On FTD, review the deployed remote access VPN policy and the resulting running configuration in Cisco Secure FMC or FDM.
- If you cannot upgrade right away, Cisco’s only mitigation is to turn off the tunnel group list when the default group does not use secondary authentication, or to remove secondary authentication from user-configured tunnel groups or the default group. Cisco’s advisory says there is no workaround, calls this a mitigation, and warns that removing secondary authentication lowers the security of remote access VPN.