Cisco published an advisory on October 28, 2026 for CVE-2026-76418, a denial-of-service vulnerability in the Remote Access SSL VPN service of Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Cisco’s PSIRT says it learned of exploitation in the wild earlier in October. The flaw is rated high severity (CVSS 8.6), and an unauthenticated remote attacker can make the device reload. This is the second actively exploited ASA/FTD SSL VPN denial-of-service zero-day since August; the first, CVE-2026-20349, is a separate bug.

Technical details

The root cause is described as an unchecked return value leading to a NULL pointer dereference in the SSL VPN login path. Logic errors are triggered when secondary authentication is configured on a tunnel group. A crafted request sent during SSL VPN connection setup causes the device to reload. No credentials are needed, and the request goes to the same internet-facing VPN portal that remote users reach.

You are exposed only if all three conditions hold:

  • the device runs a vulnerable ASA or FTD release;
  • the Remote Access SSL VPN login service is reachable by the attacker; and
  • a tunnel group in scope has secondary authentication configured (look for secondary-authentication-server-group).

If tunnel-group-list enable is set, check every tunnel group, including DefaultWEBVPNGroup, because the attacker can often select or reach groups the portal lists.

Impact

Repeated reloads give an attacker a cheap way to keep remote access down for as long as they like, and on an edge firewall that doubles as the VPN concentrator, a reload also drops the traffic the box was forwarding. Cisco has not named the actors, the victims or the scale of the campaign. Sources reviewed reported no confirmed data theft or code execution. We did not find a CISA KEV listing as of this writing, though that may change; check the catalog.

Fixed releases

Fixed versions as reported by secondary outlets (verify against the Cisco advisory before acting):

  • ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 / 9.24.10.1 (outlets differ on the 9.24 train).
  • FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1.

Mitigation

  1. Patch. Upgrade to a fixed release for your train. Patching is the supported remedy.
  2. Check exposure. Review show running-config tunnel-group for secondary authentication on any group, including the default web VPN group.
  3. Interim options are limited. Sources conflict on workarounds: one says Cisco lists none, another says that if DefaultWEBVPNGroup does not use secondary authentication you can run no tunnel-group-list enable. Removing secondary authentication weakens login security, so it is not a substitute for patching.
  4. Hunt for unexplained reloads. Review syslog and crash/traceback history for unscheduled restarts since early October, especially clustered ones following SSL VPN connection attempts, and restrict the VPN portal to expected source ranges where feasible.
  5. Plan for resilience. Two zero-days in the same component in three months suggest running HA pairs and keeping a tested upgrade path for edge firewalls.

References