Overview
Cisco has disclosed that CVE-2026-76418, a denial-of-service flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software, is being exploited in the wild. It is the second such VPN zero-day on these platforms since August.
An unauthenticated remote attacker can force an affected firewall to reload unexpectedly, interrupting VPN access and any traffic the device handles.
Vulnerability Details
| Field | Details |
|---|---|
| CVE | CVE-2026-76418 |
| CVSS Score | 8.6 |
| Component | Remote Access SSL VPN service |
| Impact | Unauthenticated denial of service (device reload) |
| Cisco Advisory | cisco-sa-asaftd-tunnel-dos-s6mgkb75 |
Cisco attributes the issue to logic errors in tunnel groups configured with secondary authentication. The malicious request is sent during the SSL VPN connection attempt, and Cisco notes that a successful VPN login is not required to reach the vulnerable code path.
A device is exposed when it runs an unpatched release, has its SSL VPN login service reachable, and uses secondary authentication in an affected tunnel group. Cisco's cloud-delivered Secure Access and Secure Firewall Management Center are not affected.
Exploitation Status
Cisco's product security team learned of in-the-wild exploitation in October 2026. The company has not shared details about the attacks or the actors behind them. The flaw was found during a Cisco TAC support case, and Cisco credited Eric Fernald.
In August 2026 Cisco patched CVE-2026-20349, an HTTP request processing flaw that also let unauthenticated attackers reload devices through the same SSL VPN service and was also exploited. It is unclear whether the same actor is behind both.
Mitigation
- No workarounds are available. Apply the fixed software releases listed in the Cisco advisory.
- Depending on the default tunnel group settings, exposure can be reduced by disabling the tunnel group list or removing secondary authentication. Cisco warns that removing secondary authentication weakens remote access VPN security and recommends upgrading instead.
- Watch for unexplained firewall reloads, crash files, and repeated SSL VPN connection attempts from unfamiliar sources.
- Restrict SSL VPN exposure to required source ranges where possible.
Why It Matters
Even without code execution, repeated forced reloads of an internet-facing firewall can cut off remote workers and branch connectivity, and can be used to mask other activity. Two exploited SSL VPN flaws in three months shows attackers are actively probing this service.