Cisco Secure Firewall VPN flaw CVE-2026-76418 exploited to crash devices
Original title: Cisco Secure Firewall 0-Day Vulnerability Exploited in the Wild to Crash SSL VPN Devices
Unauthenticated crafted requests reload ASA and FTD devices when SSL VPN secondary authentication is configured; CVSS is 8.6.
Cisco published fixes on October 28, 2026, for CVE-2026-76418 after its PSIRT learned of exploitation during October. The CVSS 8.6 flaw is in Secure Firewall ASA and FTD Remote Access SSL VPN when secondary authentication is set on a tunnel group. An unauthenticated remote attacker can send a crafted connection request and force a reload, disrupting remote access. Cisco reports no confirmed data theft or remote code execution and lists no workaround, though temporary tunnel-group mitigations exist.
Unconfirmed: Cisco identifies no attackers or victims and reports no confirmed data theft or code execution.
- Fixed ASA releases include 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, and 9.23.1.48.
- Cisco also lists ASA 9.24.1.27 and 9.24.10.1 as fixed.
- Fixed FTD releases include 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1.
- Secure FMC, cloud-delivered Firewall and FMC, and Secure Access are not affected.
- Eric Fernald found the issue while resolving a Cisco TAC support case.
Impact: Unauthenticated remote denial of service via device restarts
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Secure Firewall ASA | — | 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, 9.24.10.1 |
| Cisco Secure Firewall Threat Defense | — | 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1 |
- 1.Upgrade the matching ASA or FTD branch to a listed fixed release.
- 2.Use Cisco’s Software Checker to confirm exposure and a suitable fixed release.
- 3.Review tunnel groups, including DefaultWEBVPNGroup, for secondary authentication.
- CVEs
- CVE-2026-76418
- Vendors
- Cisco
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76418 | Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth | 8.6 | <1% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 9.24.1.27 | .96, 9.20.4.50, 9.22.3.200, and 9.23.1.48. Cisco also lists 9.24.1.27 and 9.24.10.1. Fixed FTD releases include 7.0.11, 7.2.13, 7 |
From the original article
2 min read at cybersecuritynews.com
Cisco released security updates for actively exploited CVE-2026-76418, a flaw in Secure Firewall ASA and FTD software that lets unauthenticated remote attackers force device restarts, causing denial of service and disrupting remote access. The high-severity vulnerability carries a CVSS score of 8. 6.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.