Cisco patches exploited ASA and FTD SSL VPN flaw CVE-2026-76418
Original title: Cisco Patches Actively Exploited SSL VPN Vulnerability Affecting ASA and FTD Firewalls
Unauthenticated crafted VPN requests can reload firewalls; CVSS is 8.6 and there is no workaround.
Cisco released updates for CVE-2026-76418, a high-severity flaw in Remote Access SSL VPN on Secure Firewall ASA and FTD software. PSIRT found active exploitation earlier in October, and Cisco published the advisory on October 28, 2026. With secondary authentication configured on a tunnel group, an unauthenticated attacker can send a crafted connection request that reloads the firewall. The impact is denial of service, not code execution or data theft. Cloud-delivered Firewall, Secure Access and Secure FMC Software are unaffected.
Unconfirmed: Cisco did not identify the attackers, victims or scale of exploitation.
- CVSS score is 8.6.
- ASA fixes include 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200 and 9.23.1.48.
- Listed ASA 9.24 fixes are 9.24.1.27 and 9.24.10.1.
- FTD fixes include 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1.
- Attackers, victims and campaign scale were not disclosed.
Impact: Unauthenticated denial of service by reloading the firewall
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Secure Firewall Adaptive Security Appliance (ASA) | Vulnerable ASA releases not fully enumerated | 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, 9.24.10.1 |
| Cisco Secure Firewall Threat Defense (FTD) | Vulnerable FTD releases not fully enumerated | 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1 |
- 1.Upgrade ASA and FTD to an applicable fixed release.
- 2.Use Cisco Software Checker to confirm exposure before maintenance.
- 3.Review tunnel groups for secondary authentication on reachable SSL VPN.
- CVEs
- CVE-2026-76418
- Vendors
- Cisco
- Organizations
- Cisco PSIRT
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76418 | Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth | 8.6 | <1% | KEV | KEV |
From the original article
2 min read at gbhackers.com
Cisco has released security updates that address a critical vulnerability in the Remote Access SSL VPN service on its Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software. This vulnerability, tracked as CVE-2026-76418, lets unauthenticated attackers trigger unexpected device reloads, causing a denial of service. The flaw is categorized as high severity, with […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.