Cisco firewalls: exploited SSL VPN flaw lets attackers force reloads

Cisco firewalls: exploited SSL VPN flaw lets attackers force reloads

28 October 2026: Cisco has fixed CVE-2026-76418, a high-severity flaw (CVSS 8.6) in the Remote Access SSL VPN service of Secure Firewall ASA and Secure Firewall Threat Defense (FTD) that lets an attacker who is not logged in make the device reload. Cisco's product security team says it became aware of active exploitation this month. There is no workaround, only a mitigation that weakens VPN security, so upgrading is the fix.

Which firewalls are exposed

Three conditions must all hold. The device runs a vulnerable ASA or FTD release, the SSL remote access VPN login service is reachable (on ASA, the running configuration has webvpn with enable on at least one interface), and secondary authentication is configured on a tunnel group. The logic error sits in how the VPN service handles a connection when that second authentication server group is set, and Cisco notes that a successful VPN login is not needed to reach the faulty code.

The check is wider than the login page suggests. Where tunnel-group-list enable is configured, every tunnel group counts, including the default group DefaultWEBVPNGroup and profiles that are not shown in the drop-down list. Where the group list has been switched off, DefaultWEBVPNGroup still has to be checked, because disabling the list does not remove exposure if the default group uses secondary authentication. On FTD, the place to look is the deployed remote access VPN policy in Secure Firewall Management Center or Device Manager, and the running configuration it produces.

Cisco says Cloud-delivered Firewall, cloud-delivered FMC, Secure Access and Secure FMC software are not affected.

First fixed releases

ASA:

• 9.16 and earlier: 9.16.4.104
• 9.18: 9.18.4.96
• 9.20: 9.20.4.50
• 9.22: 9.22.3.200
• 9.23: 9.23.1.48
• 9.24: 9.24.1.27 or 9.24.10.1

FTD:

• 7.0 and earlier: 7.0.11
• 7.2: 7.2.13
• 7.4: 7.4.9
• 7.6: 7.6.7
• 7.7: 7.7.14
• 10.0: 10.0.3
• 10.1: 10.1.1

If an upgrade has to wait

Cisco offers two mitigations, each with a cost. If DefaultWEBVPNGroup does not use secondary authentication, no tunnel-group-list enable in WebVPN configuration mode removes the group list, and users then have to know which connection profile to use. If the default group does use secondary authentication, no secondary-authentication-server-group removes it, which lowers the security of remote access logins. Cisco tested the mitigation but tells customers to judge its effect in their own environment first.

The impact is availability: a reload drops every VPN session and, on a firewall at the edge, traffic through it. Repeated reloads are what an attacker would aim for. Cisco does not say who is exploiting the flaw or how widely, and the advisory carries no indicators. Unexpected reloads of an ASA or FTD with SSL VPN enabled since early October are the thing to look for in device logs and crash files. The flaw was found by Eric Fernald while resolving a Cisco TAC support case, and is tracked as bug CSCwx26625.

Italy's national cybersecurity agency repeated the exploitation warning a day after Cisco published. Our VPN software category lists 13 products and our network security software category six, and we list Cisco as a company.

Sources

• Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75, 28 October 2026
• ACN CSIRT Italia: Cisco, rilevato sfruttamento in rete della CVE-2026-76418, 29 October 2026