Summary
On October 28, 2026, Cisco released fixes for CVE-2026-76418 (CVSS 8.6), a denial-of-service zero-day in Cisco Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Cisco says it is being exploited in the wild to remotely force vulnerable firewalls to reload. It is the second exploited SSL VPN zero-day in these products since August, following CVE-2026-20349.
Technical Details
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-76418 |
| CVSS | 8.6 (High) |
| Component | Remote Access SSL VPN (webvpn) |
| Root cause | Logic errors when secondary authentication is configured on a tunnel group |
| Authentication required | None — a successful VPN login is not needed to reach the code path |
| Impact | Device reload (availability only; no code execution or data theft reported) |
An attacker sends a crafted request during an SSL remote access VPN connection attempt, causing the device to reload. Repeated requests could keep a firewall cycling.
Exposure Conditions
A device is vulnerable only when both of the following are true:
- The
webvpnkeyword is enabled on at least one interface - A secondary authentication server group is configured on a tunnel group or on
DefaultWEBVPNGroup
Affected and Fixed Versions
| Product | Affected | Fixed releases |
|---|---|---|
| Cisco ASA | 9.16 through 9.24 | 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, 9.24.10.1 |
| Cisco FTD | 7.0 through 10.1 | 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1 |
Cloud-delivered Firewall Management Center, cdFMC, Secure Access and Secure FMC are not affected.
Exploitation Status
Cisco learned of active exploitation in October 2026 but has not said when attacks began, who is behind them, or how widespread they are. The search coverage reviewed did not confirm whether CISA has added the flaw to its KEV catalog. Shadowserver tracks more than 51,000 Cisco ASA SSL VPN devices exposed online, though it does not say how many are patched or are honeypots.
Recommendations
- Upgrade to a fixed ASA or FTD release listed above. Cisco offers no complete workaround.
- If you cannot patch immediately, disable secondary authentication on
DefaultWEBVPNGroupand any user-configured tunnel group. Cisco notes this only reduces exposure. - Check for unexpected reloads in device logs and crash information over recent weeks.
- Review internet exposure of the SSL VPN portal and restrict it where feasible.
- Plan for resilience: a reload-only attack on a perimeter firewall still takes remote access offline, so confirm failover and out-of-band access work.