Cisco says a high-severity flaw in the remote access SSL VPN service of Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software is being exploited, and it has released fixed versions.
The flaw is tracked as CVE-2026-76418 and carries a CVSS base score of 8.6. According to Cisco’s advisory, first published on October 28, an unauthenticated remote attacker can send a crafted request while connecting to the SSL VPN and make the device reload, which causes a denial of service. Cisco attributes the flaw to logic errors when secondary authentication is configured on a tunnel group, and states that a successful VPN login is not required to reach the affected processing path. Cisco’s PSIRT became aware of active exploitation in October 2026. The advisory does not say who is behind the attacks.
A device is exposed when it runs a vulnerable release, the SSL remote access VPN login service is reachable, and secondary authentication is set in a tunnel group. Cisco says that includes the default group, DefaultWEBVPNGroup, and that turning off the tunnel group list does not remove exposure when the default group uses secondary authentication.
The first fixed ASA releases are 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 and 9.24.1.27, with 9.24.10.1 also listed. For FTD they are 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. Cisco says no workaround addresses the flaw. It describes one mitigation, removing secondary authentication on the affected tunnel groups, and warns that doing so lowers the security posture of remote access VPN. It strongly recommends upgrading.
In our reading, a reload loop on a VPN edge takes remote access down for every user behind it, so unexplained ASA or FTD reloads deserve a check against this advisory. Start with an inventory of SSL VPN units and their tunnel groups. Cisco’s earlier exploited-flaw advisory for its email gateway is covered in our report on CVE-2026-76519, and the case for rebuilding rather than trusting an exploited appliance is in our opinion on edge appliances.
Source: Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75
