Cisco has released security updates for CVE-2026-76418, an actively exploited vulnerability in Secure Firewall ASA and FTD software that allows unauthenticated remote attackers to trigger device restarts, causing denial of service and interrupting remote access.
The vulnerability is rated high severity with a CVSS score of 8.6. Cisco published its advisory on October 28, 2026, after its Product Security Incident Response Team identified evidence of active exploitation during October. The issue was discovered by Eric Fernald while addressing a Cisco Technical Assistance Center support case.
The flaw is caused by logic errors in the Remote Access SSL VPN service when secondary authentication is configured for a tunnel group. An attacker can send a specially crafted request while connecting to the VPN service that reaches the affected processing path and forces an unexpected device reload. A successful VPN login is not required for the request to reach that path.
Cisco’s advisory confirms the issue results in denial-of-service conditions that cause device restarts and service disruption. The company reports no identified attackers or victims and no confirmed data theft or remote code execution related to this vulnerability.
Cisco Secure Firewall 0-day
This issue follows earlier Cisco firewall VPN crash attacks such as CVE-2026-20349 and is distinct from the previously reported ASA code execution vulnerability CVE-2025-20333. Each of these flaws has a different root cause and should be treated separately.
Exploitation requires: vulnerable ASA or FTD software, an accessible SSL remote access VPN login service, and secondary authentication configured in the relevant tunnel group.
Administrators should verify whether webvpn is enabled on any interface and inspect tunnel-group configurations for the presence of secondary-authentication-server-group.
If tunnel-group-list enable is configured, checks must include all tunnel groups — including the DefaultWEBVPNGroup — and not only the profiles displayed on the login page.
Removing the group list does not necessarily remove exposure if the default group still uses secondary authentication. Cisco also notes that Secure FMC, Cloud-delivered Firewall, cloud-delivered FMC, and Secure Access are not affected by this vulnerability.
Fixed ASA releases include: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, and 9.24.10.1.
Fixed FTD releases include: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1. Administrators should choose the appropriate fixed release for their software branch.
Cisco lists no full workaround but provides temporary mitigation guidance that depends on tunnel-group settings. Disabling the group list may mitigate exposure when the default group does not use secondary authentication.
If removing secondary authentication is considered, organizations should be aware that this reduces VPN security and must be evaluated carefully. Cisco strongly recommends applying the provided patches and using its Software Checker to determine which releases are exposed and to identify appropriate fixed software before scheduling upgrades.
Give your SOC the alert context to stop incidents quickly. Integrate threat intelligence from 16K SOCs.
