CVE-2026-76418

What is Cisco Secure Firewall ASA and FTD?

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software are the two operating systems that run Cisco's firewall hardware. ASA is the long-lived classic platform; FTD is the newer image that folds in Firepower intrusion prevention. Both provide the Remote Access SSL VPN service that terminates AnyConnect and Secure Client sessions, which is why these appliances sit at the network edge with their VPN login service deliberately exposed to the whole internet.

That position is exactly what makes them attractive. A firewall is the gateway every remote employee passes through, it cannot be patched without a maintenance window, and it rarely carries an EDR agent. Shadowserver tracks more than 51,000 internet-exposed Cisco ASA SSL VPN devices, and CISA has flagged 101 Cisco flaws as exploited in the wild since November 2021.

Overview

CVE-2026-76418 lets an unauthenticated remote attacker reload an ASA or FTD device by sending a crafted request to the Remote Access SSL VPN login service. The result is a denial of service: the firewall restarts, every VPN session and every flow traversing it drops, and a persistent attacker can keep the device in a reload loop. Cisco rates it 8.6 with scope changed, reflecting that crashing the firewall takes down traffic for everything behind it, not just the VPN process itself.

The trigger is specific. The flaw lives in the handling of tunnel groups that have a secondary authentication server group configured, and Cisco describes the root cause as logic errors in that path. Crucially, Cisco states that "a successful VPN login is not required to reach the affected processing path", so the attacker needs no credentials and no valid account.

This is the second actively exploited denial-of-service zero-day in the ASA and FTD Remote Access SSL VPN service in three months. CVE-2026-20349, patched in August 2026, was an HTTP request processing bug that also forced unauthenticated reloads. It is not publicly known whether the same actor is behind both. The broader pattern reaches back further, to the ArcaneDoor campaign and the September 2025 pair CVE-2025-20333 and CVE-2025-20362, which prompted CISA Emergency Directive 25-03 and its 24-hour remediation clock.

Affected Versions

A device is vulnerable only if all of these hold: the running configuration contains the webvpn keyword with SSL VPN enabled on at least one interface; the SSL remote access VPN login service is reachable; and secondary-authentication-server-group is configured on any tunnel group. Cisco warns that checking only the connection profiles shown on the VPN login page is not sufficient, because DefaultWEBVPNGroup is still evaluated even when tunnel-group-list enable is absent.

Cloud-delivered Firewall Management Center (cdFMC), Cloud-delivered Firewall (CDFW), Cisco Secure Access, and on-premises Secure Firewall Management Center Software are confirmed not affected.

Technical Details

CWE-690, unchecked return value to NULL pointer dereference, means a function that can fail and return a null pointer is called without testing the result, and the caller then dereferences that null pointer. On ASA and FTD that fault is not survivable in-process: the appliance reloads.

In this case the lookup sits in the secondary authentication branch of tunnel group processing. An attacker who sends a crafted request while initiating an SSL remote access VPN connection drives that lookup down a path where it returns null, and the unchecked dereference follows immediately. Cisco tracks the defect as bug ID CSCwx26625.

The attack characteristics are about as favourable to an attacker as they get for a DoS: network vector, low complexity, no privileges, no user interaction, and no prior VPN login. A single crafted request to a reachable VPN login endpoint is sufficient. The confidentiality and integrity impacts are rated None, so this is a disruption bug rather than a foothold, though a forced reload can also serve as cover or as a way to clear volatile forensic state.

Discovery

Cisco credits Eric Fernald with finding the vulnerability, noting that it was identified during the resolution of a Cisco TAC support case. That origin is worth reading literally: the bug surfaced from a customer device actually crashing, which is consistent with Cisco PSIRT separately confirming active exploitation in October 2026 rather than a researcher-led disclosure. Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 at version 1.0 on 2026-10-28 at 19:15 GMT, with no subsequent revisions at the time of writing.

Exploitation Context

Cisco PSIRT states it became aware of active exploitation of this vulnerability in October 2026, which makes this a zero-day: attacks preceded the fix. Cisco has not published indicators of compromise, has not named the targeted organisations, and has not attributed the activity to any actor. No ransomware use has been reported, and no public proof of concept exists as of 2026-10-29.

Exposure is the main driver of risk here. With more than 51,000 ASA SSL VPN devices reachable from the internet, the vulnerable subset is whatever fraction of those uses secondary authentication on a tunnel group, which is a common configuration in environments that layer a second factor behind the primary RADIUS or LDAP server. Cisco's warning about DefaultWEBVPNGroup means some administrators will conclude they are unaffected when they are not.

CISA added the CVE to KEV one day after the advisory, with a three-day remediation deadline.

Remediation

1. Upgrade to the fixed release for your train. There are no workarounds that fully address the vulnerability; Cisco strongly recommends upgrading.
2. Determine exposure precisely before deciding to defer. Confirm whether webvpn is in the running configuration with SSL VPN enabled on an interface, then check every tunnel group, including DefaultWEBVPNGroup, for secondary-authentication-server-group. Do not rely on the connection profiles visible on the VPN login page.
3. If you cannot patch immediately, apply Cisco's mitigation. Where DefaultWEBVPNGroup does not use secondary authentication, run no tunnel-group-list enable. Where it does, run no secondary-authentication-server-group. Cisco notes explicitly that the second option reduces remote access VPN security by removing a factor, so treat it as temporary and compensate elsewhere.
4. Restrict reachability of the SSL VPN login service where the business allows it, for example by geofencing or allowlisting source ranges at an upstream device. The flaw requires only that the login service be reachable.
5. Review logs and device state for unexplained reloads, crash dumps referencing the WebVPN or tunnel group authentication path, and clusters of malformed SSL VPN connection attempts from a single source. Preserve crash artefacts before reloading or upgrading.
6. Patch alongside the other recent ASA and FTD items rather than in isolation, including CVE-2026-20349 from August 2026, since the same VPN service is the common target.
7. Federal civilian agencies must remediate by 2026-11-01 under BOD 26-04, and must follow CISA's BOD 26-04 forensic triage requirements before remediating, because an upgrade and reload discard volatile evidence.