CVE-2026-76418 Cisco Secure Firewall ASA and FTD Flaw
CVE-2026-76418 is a denial-of-service flaw in the Remote Access SSL VPN of Cisco Secure Firewall ASA and FTD software. CISA added it to its KEV catalog on 2026-10-29, so treat it as actively exploited.
Short answer: CVE-2026-76418 lets an unauthenticated remote attacker crash and reload Cisco Secure Firewall ASA and FTD devices that run the Remote Access SSL VPN with secondary authentication on a tunnel group. It scores CVSS 8.6 HIGH and is in CISA's KEV catalog, so patch per the Cisco advisory now and check your VPN configuration today.
An unauthenticated attacker on the internet can make a Cisco Secure Firewall ASA or FTD device reload by sending one crafted request to its SSL VPN. CISA added CVE-2026-76418 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-29, so you should treat it as exploited in the wild.
What happened
The NVD record describes a flaw in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The cause is logic errors when secondary authentication is configured on a tunnel group.
An attacker sends a crafted request while connecting to the SSL remote access VPN. The device reloads unexpectedly, which causes a denial of service (DoS). No login is needed.
The weakness is tracked as CWE-690, unchecked return value to NULL pointer dereference. In plain terms, the code does not check whether a step worked, then uses an empty value and crashes. NVD published the record on 2026-10-28.
Who is affected
You are in scope if all of these are true:
You run Cisco Secure Firewall ASA Software or Cisco Secure Firewall Threat Defense (FTD) Software.
The Remote Access SSL VPN service is enabled.
A tunnel group has secondary authentication configured.
A firewall without the SSL VPN service, or without secondary authentication on its tunnel groups, does not match the conditions NVD describes. Confirm this in the Cisco advisory rather than assuming. Fixed release numbers are not in the NVD record, so read the Cisco security advisory for the exact affected and fixed versions for your platform.
How serious it is
Item | Detail |
|---|---|
CVSS | 8.6 HIGH ( |
Access needed | Network only, no privileges, no user interaction |
Impact | Availability only: device reload and DoS |
CISA KEV | Added 2026-10-29 |
Federal due date | 2026-11-01 |
Known ransomware use | Unknown |
The 8.6 score comes from network access with no privileges, a changed scope and high availability impact. The vector lists no confidentiality or integrity impact, so the flaw does not expose data or let an attacker change settings. But a perimeter firewall that reloads can cut off remote workers and branch links. An attacker who can repeat the request may cause repeated reloads.
The due date is only a few days after the KEV listing. That tells you CISA sees real exploitation and wants fast action. The KEV entry has the full listing.
What to do now
1. Find out if you are exposed
Log in to the ASA CLI. On FTD, enter the diagnostic CLI first with system support diagnostic-cli, then enable. These commands are standard on ASA, but confirm the exact syntax for your release.
show version | include Version
show running-config webvpn
show running-config tunnel-group
show running-config | include secondary-authenticationRead the output like this:
show versiongives the running release. Compare it with the fixed releases in the Cisco advisory.webvpnwith anenable <interface>line means the SSL VPN listens on that interface.Any
secondary-authentication-server-groupline under a tunnel group is the condition the NVD record names.
If you manage FTD with Firewall Management Center, also review the remote access VPN policy there. Look for connection profiles that use a secondary authentication server.
2. Check for unexpected reloads
show uptime
show crashinfoA short uptime that you cannot explain, or fresh crash data, is worth a ticket. CISA's guidance for this entry points to its "Forensics Triage Requirements". Follow them, and save logs and crash files before you upgrade or reboot.
3. Patch or mitigate
Apply the fix or mitigation steps from the Cisco advisory. CISA's required action also says to follow BOD 26-04 guidance. You must evaluate each asset's internet exposure and follow the BOD 26-04 patching guidelines. For cloud services, follow the applicable BOD 26-04 guidance. If mitigations are unavailable, CISA says to discontinue use of the product.
A simple order of work:
Internet-facing firewalls with the SSL VPN and secondary authentication.
Internet-facing firewalls with the SSL VPN but no secondary authentication.
Internal or lab devices.
4. Reduce exposure while you wait
Limit which source networks can reach the VPN interface, if your design allows it.
Watch syslog and your monitoring for repeated VPN connection attempts followed by a reload.
Plan failover. If you run an HA pair, schedule the upgrade so one unit stays up.
What learners can take from this
This bug is a good case study in why input handling and return-value checks matter, and why exposed VPN gateways get attacked first. If you are building security skills, practice reading a CVE record: the attack vector, the preconditions (here, secondary authentication on a tunnel group), and the CISA KEV status. That habit is also what vulnerability management questions test. Our free CompTIA Security+ study guide covers this kind of risk-based prioritization.
If you want more certification options, browse our Cybersecurity category.
Sources
Questions about this topic
Does an attacker need credentials to trigger CVE-2026-76418?
No. The NVD record says the attacker is unauthenticated and remote. They only need to reach the SSL remote access VPN and send a crafted request while connecting.
Can this flaw be used to steal data or take over the firewall?
The CVSS vector lists no confidentiality or integrity impact, only high availability impact. The documented result is a device reload and denial of service.
Is CVE-2026-76418 being exploited?
CISA added it to the KEV catalog on 2026-10-29, which means exploitation has been observed. Whether ransomware groups use it is listed as unknown.
What is BOD 26-04 and why does it matter here?
It is CISA's directive on prioritizing security updates based on risk. CISA's required action for this entry tells stakeholders to evaluate each asset's internet exposure and follow its patching guidelines.
What if I cannot patch right away?
Follow the mitigations in the Cisco advisory and limit who can reach the VPN interface. CISA says to discontinue use of the product if mitigations are unavailable.