Cisco ASA and FTD SSL VPN flaw exploited to crash devices
Original title: New Cisco firewall zero-day being actively exploited
CVE-2026-76418, scored 8.6, lets an unauthenticated attacker reload ASA or FTD when secondary authentication is configured; Cisco has fixes but no workaround.
Cisco says a logic error in the Remote Access SSL VPN service of Secure Firewall ASA and Secure Firewall Threat Defense is being exploited to crash devices. A remote, unauthenticated attacker can send a crafted connection request when secondary authentication is set on a tunnel group, forcing a reload and denial of service. Exposure depends on webvpn and SSL VPN settings and on secondary-authentication-server-group, including DefaultWEBVPNGroup. Cisco released fixed ASA and FTD versions and says there are no workarounds, though disabling secondary authentication is a temporary mitigation.
- Fixed ASA releases include 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, and 9.24.10.1.
- Fixed FTD releases include 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1.
- Disabling the tunnel-group list does not remove exposure on the default group.
- Cisco Software Checker identifies affected software and the earliest fixed release.
Impact: Unauthenticated remote denial of service by reloading the device
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Secure Firewall Adaptive Security Appliance | — | 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, 9.24.10.1 |
| Cisco Secure Firewall Threat Defense | — | 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1 |
- 1.Update ASA and FTD to a fixed release Cisco lists.
- 2.Until patched, disable secondary authentication on affected tunnel groups, including DefaultWEBVPNGroup.
- CVEs
- CVE-2026-76418
- Vendors
- Cisco
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76418 | Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth | 8.6 | <1% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 9.24.10.1 | 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, and 9.24.10.1. Patched releases for Secure FTD are versions 7.0.11, 7.2.1 |
From the original article
2 min read at csoonline.com
A high-severity flaw in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) is under active exploitation to crash vulnerable devices. The vulnerability, tracked as CVE-2026-76418 and rated 8. 6 in severity, is due to logic errors when secondary authentication is configured on a tunnel group, Cisco said in its advisory.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.