CVE-2026-76418: Cisco ASA and FTD SSL VPN Secondary-Authentication Flaw Lets Unauthenticated Attackers Reload Firewalls

Background

Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) are perimeter firewalls that commonly terminate remote-access SSL VPN. A device that reloads on demand drops VPN access and, on single-unit deployments, the traffic the firewall protects.

Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 on 2026-10-28 (Bug ID CSCwx26625). Cisco’s advisory says its PSIRT became aware of active exploitation in October 2026. CISA added CVE-2026-76418 to KEV on 2026-10-29 with a due date of 2026-11-01.

Technical Mechanism

Cisco (as CNA) lists CWE-690, as does the KEV entry (unchecked return value to NULL pointer dereference). Cisco describes the flaw as logic errors in the Remote Access SSL VPN service when secondary authentication is configured on a tunnel group. An unauthenticated remote attacker sends a crafted request when connecting to the SSL VPN and the device reloads. Cisco states a successful VPN login is not required to reach the affected processing path.

A device is vulnerable only when all three hold, per Cisco:

1. It runs a vulnerable ASA or FTD release.
2. The SSL remote access VPN login service is reachable. Cisco’s way to check the configuration: webvpn with SSL VPN enabled on at least one interface in the running configuration (for FTD, check the remote access VPN policy in FMC or FDM).
3. A tunnel group, including the default DefaultWEBVPNGroup, has secondary-authentication-server-group. If tunnel-group-list enable is absent, the default group still has to be checked. The check is not limited to profiles shown on the login page.

The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H (8.6). The score is Cisco’s own (CNA, secondary source); as of 2026-10-30 NVD is “Undergoing Analysis” with no NVD-primary score.

Real-World Exploitation Evidence

• Cisco PSIRT: “In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” Cisco gives no actor, campaign or victim details in the advisory.
• CISA KEV: added 2026-10-29, due 2026-11-01; forensic triage flag No; ransomware campaign use Unknown.
• CISA-ADP SSVC (NVD, 2026-10-28): exploitation active, automatable yes, technical impact partial.
• Threat actors: no evidence found as of 2026-10-30 in the Cisco advisory, NVD or the KEV entry of a named actor. Attribution is unknown.
• Discovery: Cisco credits Eric Fernald, who found it while resolving a Cisco TAC support case.

Impact Assessment

Per Cisco, impact is availability only: the device reloads. The CVSS vector scores no confidentiality or integrity impact. Because the attack needs no credentials and SSVC marks it automatable, repeated reloads are plausible (our assessment). Our assessment, not a Cisco statement: organisations that depend on this firewall for remote-access VPN are likely to feel a reload most.

Affected Versions

Cisco’s advisory lists the first fixed release per train, not an affected-version list. Releases before them in a train are treated as affected here (our reading), provided the configuration conditions above are met; “9.16 and earlier” means those trains should move to 9.16.4.104 or a later train. Cisco strongly recommends upgrading; its mitigation is temporary.

Not affected per Cisco: Cloud-delivered Firewall, cdFMC, Secure Access, Secure FMC Software.

Remediation Steps

1. Upgrade to the first fixed release for your train from the tables above; Cisco’s Software Checker can confirm the release for your platform.
2. If you cannot upgrade immediately, Cisco says there is no workaround but offers a mitigation: disable secondary authentication on user-configured tunnel groups and on DefaultWEBVPNGroup.
3. If DefaultWEBVPNGroup does not use secondary authentication, run no tunnel-group-list enable in WebVPN configuration mode. Users then have to know the correct profile name.
4. If DefaultWEBVPNGroup does use secondary authentication, run no secondary-authentication-server-group. Cisco notes this lowers remote access VPN security posture.
5. Cisco calls the mitigation a temporary measure until you upgrade. Cisco says it “has been deployed and was proven successful in a test environment” and tells customers to evaluate its applicability and impact in their own environment first.

Detection Guidance

No indicators of compromise or log signatures found as of 2026-10-30 in the Cisco advisory text. Our suggestions, not from the vendor: review syslog and device uptime for unexplained reloads or crashes since 2026-10-01; correlate with SSL VPN connection attempts from unfamiliar addresses immediately before each reload; and inventory tunnel groups for secondary-authentication-server-group to size exposure.

Timeline

References

• Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75
• NVD: CVE-2026-76418
• CISA KEV catalog entry