Cisco ASA and FTD Zero-Day CVE-2026-76418: Exploited SSL VPN Flaw Crashes Firewalls on Demand

Cisco has patched a high-severity zero-day in its Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software that attackers are already using to knock firewalls offline. Tracked as CVE-2026-76418 (CVSS 8.6, Cisco bug CSCwx26625), the flaw lives in the Remote Access SSL VPN service and lets an unauthenticated, remote attacker force the device to reload unexpectedly with a single crafted connection request. Cisco published the advisory on October 28, 2026 and says its PSIRT became aware of active exploitation earlier this month. For any shop whose remote workforce lives behind an ASA or Firepower box, a firewall that reboots on demand is an outage waiting to happen, so here’s what’s affected, which builds fix it, and how to buy time if you can’t upgrade tonight.

The Zero-Day: A Logic Error in Secondary Authentication

According to Cisco, the bug is caused by “logic errors when secondary authentication is configured on a tunnel group.” An attacker who sends a crafted request while connecting to the SSL remote access VPN can make the device reload, producing a denial-of-service (DoS) condition. Critically, Cisco notes that a successful VPN login is not required to reach the vulnerable code path, which means anyone who can reach your VPN portal can pull the trigger.

The company has not shared indicators of compromise, the scale of the attacks, or who is behind them. As BleepingComputer pointed out, Cisco simply confirmed that “in October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” Interestingly, the flaw itself was found by Cisco engineer Eric Fernald while working a Technical Assistance Center (TAC) support case, a reminder that “random firewall reboots” tickets are sometimes something more sinister.

Are You Exposed? Check These Configurations

A device is vulnerable only when three conditions line up: it runs an affected ASA or FTD release, the SSL remote access VPN login service is reachable, and secondary authentication is configured in the relevant tunnel group scope. Here’s how to check:

• SSL VPN enabled: if the running config contains the webvpn keyword and webvpn enable <interface_name> on at least one interface, the SSL VPN side of the test is met.
• Tunnel group list enabled: if tunnel-group-list enable is configured, check every tunnel group, including DefaultWEBVPNGroup, for secondary-authentication-server-group. Cisco stresses this is not limited to profiles shown on the login page.
• Tunnel group list disabled: you’re not off the hook. If DefaultWEBVPNGroup uses secondary authentication, the device is still exposed.
• FTD devices: review the deployed remote access VPN policy and the resulting running config in Secure Firewall Management Center (FMC) or Secure Firewall Device Manager (FDM).

Cisco has confirmed that Cloud-delivered Firewall, cloud-delivered FMC, Cisco Secure Access and Secure FMC Software are not affected.

The Fix: Upgrade to These Releases

Cisco says there are no workarounds and “strongly recommends that customers upgrade to a fixed software release.” The first fixed builds are:

• ASA 9.16 and earlier: 9.16.4.104
• ASA 9.18 / 9.20 / 9.22: 9.18.4.96, 9.20.4.50 and 9.22.3.200
• ASA 9.23 / 9.24: 9.23.1.48, and 9.24.1.27 or 9.24.10.1
• FTD 7.0 and earlier / 7.2 / 7.4: 7.0.11, 7.2.13 and 7.4.9
• FTD 7.6 / 7.7: 7.6.7 and 7.7.14
• FTD 10.0 / 10.1: 10.0.3 and 10.1.1

Because ASA and FTD advisories tend to arrive in clusters, run your current version through the Cisco Software Checker so you land on a “combined first fixed” release that also covers other recent advisories, rather than upgrading twice.

Can’t Patch Yet? Cisco’s Temporary Mitigation

While there’s no true workaround, Cisco does offer a mitigation that removes the vulnerable condition, with trade-offs IT teams need to weigh:

• Case 1, DefaultWEBVPNGroup has no secondary auth: run no tunnel-group-list enable in WebVPN configuration mode. Users will no longer pick a connection profile from a drop-down list and will need to know the correct profile to use.
• Case 2, DefaultWEBVPNGroup uses secondary auth: remove it with no secondary-authentication-server-group. Cisco warns plainly that this lowers the security posture of remote access VPN.
• Test first: Cisco says the mitigation was proven in a test environment, but customers should evaluate it in their own environment before deploying.

For most organizations, trading away a second authentication factor to dodge a DoS bug is a poor bargain, which makes a scheduled emergency upgrade the cleaner path.

Why It Matters for IT Teams

A DoS bug might sound less scary than remote code execution, but on a perimeter firewall it hits where it hurts. Every reload drops remote access VPN sessions, interrupts site traffic and can trigger failover churn in HA pairs. Cisco’s ASA line has also been a favorite target of state-backed and criminal groups for years. With exploitation already confirmed and no workaround that comes free, this belongs at the top of the change calendar.

Looking Ahead

With exploitation confirmed, this CVE is a strong candidate for CISA’s Known Exploited Vulnerabilities catalog and will be lighting up vulnerability-scanner dashboards in the coming days. Teams should also watch Cisco’s advisory for updates, since the company has not yet shared indicators of compromise or attribution details that would help with retroactive log hunting.

In the meantime, the playbook is straightforward: inventory every ASA and FTD with SSL VPN enabled, check tunnel groups for secondary authentication, and get the fixed builds rolled out. Unexplained firewall reloads since early October deserve a second look, too.

Sources:

• Cisco, October 28, 2026
• BleepingComputer, October 29, 2026
• The Hacker News, October 29, 2026