Cisco ASA and FTD VPN Flaw Exploited: Versions to Patch

Cisco has confirmed that attackers are exploiting CVE-2026-76418, a flaw in Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. An unauthenticated attacker can force a device running SSL VPN to reload, cutting off remote access for staff. Fixed releases are available for every supported version train.

What Cisco disclosed

Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 on October 28, 2026. The bug sits in the Remote Access SSL VPN service, the feature employees use to reach the office network from outside. It carries a CVSS score of 8.6, rated high severity.

Cisco attributes the flaw to logic errors when secondary authentication is configured on a tunnel group, which is a VPN connection profile. An attacker only needs to send a crafted request while opening an SSL VPN connection. The device then reloads, and every active VPN session drops while it restarts.

Cisco says its PSIRT became aware of active exploitation in October 2026. A day after the advisory, on October 29, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until November 1, 2026 to address it.

Cisco has not said who is behind the attacks, when they started, or how many organizations were targeted, as The Hacker News noted. The advisory also lists no indicators of compromise that administrators could search for in logs.

Which devices are affected

Not every ASA or FTD firewall is exposed. The advisory lists three conditions that must all apply:

1. the device runs a vulnerable ASA or FTD release;
2. the SSL VPN login service is reachable, shown by a webvpn block with enable <interface_name> in the running configuration;
3. secondary authentication is configured at the tunnel group level, shown by a secondary-authentication-server-group line.

One detail is easy to miss. If tunnel-group-list enable is configured, administrators must check every tunnel group, including DefaultWEBVPNGroup, and the check is not limited to profiles shown on the VPN login page. If the group list is disabled, DefaultWEBVPNGroup still needs checking, because turning off the list does not remove exposure when that default group uses secondary authentication.

On FTD, the review covers the Remote Access VPN policy in Cisco Secure FMC or FDM and the running configuration it produces. Cisco stresses that an attacker does not need a successful VPN login to reach the vulnerable code path.

Cloud-delivered Firewall, cdFMC, Cisco Secure Access, and Secure FMC Software are not affected.

Fixed releases to install

Cisco says no workaround fully addresses the flaw and strongly recommends upgrading. These are the first fixed releases for each train, according to the advisory:

• ASA: 9.16 and earlier to 9.16.4.104; 9.18 to 9.18.4.96; 9.20 to 9.20.4.50; 9.22 to 9.22.3.200; 9.23 to 9.23.1.48; 9.24 to 9.24.1.27 or 9.24.10.1.
• FTD: 7.0 and earlier to 7.0.11; 7.2 to 7.2.13; 7.4 to 7.4.9; 7.6 to 7.6.7; 7.7 to 7.7.14; 10.0 to 10.0.3; 10.1 to 10.1.1.

Cisco also offers the Cisco Software Checker to confirm whether a specific release is affected. It helps when an organization runs several devices on different versions.

Temporary mitigation if you cannot upgrade yet

The advisory describes two temporary mitigations. If DefaultWEBVPNGroup does not use secondary authentication, administrators can run no tunnel-group-list enable in WebVPN configuration mode. Users then have to type the correct connection profile name, since the drop-down list disappears.

If DefaultWEBVPNGroup does use secondary authentication, Cisco points to the no secondary-authentication-server-group command. Cisco warns that this lowers the security posture of remote access VPN, because the second authentication layer is removed. Both options are stopgaps until a fixed release is installed.

Availability as the target

The flaw does not give attackers access to data. The damage is to availability: a firewall forced to reload again and again leaves employees, branches, and partners who rely on the VPN unable to work. Where the firewall sits in the main traffic path, the outage can also affect other services behind it.

The pool of exposed devices is large. BleepingComputer cited Shadowserver data tracking more than 51,000 internet-exposed Cisco ASA SSL VPN devices. That figure does not show how many have been updated.

VPN gateways have been a repeated target in recent years. BleepingComputer noted that Cisco patched two ASA and FTD zero-days in September 2025 that it linked to the ArcaneDoor campaign. In October 2026, Merakit also covered a zero-day chain in Ivanti Connect Secure that hit the same kind of remote access gateway. The pattern suggests VPN gateways belong at the top of any patching schedule.

What this means for banks and financial institutions

Banks, rural banks, finance companies, and fintech firms rely heavily on VPNs to connect branches, remote operations teams, and support vendors. A VPN outage during business hours can halt work that depends on core systems. A flaw that “only” causes a reload still deserves fast treatment. IT teams can take the following steps today.

Inventory devices and versions

List every ASA and FTD firewall, including standby units and branch devices that rarely get attention. Match each version against the fixed releases above or run it through the Cisco Software Checker.

Check SSL VPN and tunnel group settings

Look for a webvpn block with enable on an interface, then check each tunnel group, including DefaultWEBVPNGroup, for secondary-authentication-server-group. Devices that meet all three conditions come first.

Install fixed releases in a short maintenance window

Schedule the upgrade outside business hours, back up the configuration, and test VPN logins afterwards. If the upgrade has to wait, apply the advisory’s temporary mitigation and record the risk for management.

Watch for unscheduled reloads

The advisory provides no indicators of compromise. An unexpected reload on a firewall running SSL VPN should therefore be logged as an incident and reported to the security team. Sending firewall logs to a monitoring system makes this pattern visible quickly.

Organizations without a routine process for tracking and updating network devices can use cybersecurity services to build one, from asset lists to maintenance schedules. Financial institutions building or upgrading their systems can see how Merakit approaches financial services solutions with access availability in mind.

Frequently asked questions

Can attackers steal data through this flaw?

According to Cisco’s advisory and the CISA catalog, the impact of CVE-2026-76418 is denial of service: the device reloads unexpectedly. Cisco does not mention data exposure or code execution. Repeated firewall outages can still stop operations.

Are devices without secondary authentication safe?

According to the advisory, a device is affected only when all three conditions apply, including secondary authentication at the tunnel group level. Devices without that setting do not meet the conditions. Cisco still recommends upgrading to a fixed release, since configurations can change later.

Is disabling the tunnel group list enough?

Not necessarily. Cisco states that disabling the group list does not remove exposure if DefaultWEBVPNGroup uses secondary authentication. Mitigations are temporary, and Cisco strongly recommends upgrading to a fixed release.

Closing

CVE-2026-76418 targets the part of the network that lets organizations work from anywhere: the VPN gateway. Fixes are available, the vulnerable conditions are clearly defined, and the checks fit within a single working day. If your team needs help reviewing configurations or planning updates for network devices, the Merakit team is ready to talk.

Sources

• Cisco Secure Firewall ASA and FTD Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability, Cisco, October 28, 2026
• Known Exploited Vulnerabilities Catalog, CISA, CVE-2026-76418 entry added October 29, 2026
• Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls, The Hacker News, October 29, 2026
• Cisco warns of firewall zero-day exploited to crash SSL VPN devices, BleepingComputer, October 2026
• CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV, The Hacker News, October 30, 2026