What matters now
Current position: Patch available. Cisco rates it High (CVSS 3.1 base score 8.6). A partial mitigation is described but Cisco says no workaround addresses the vulnerability.
Affected versions: Cisco Secure Firewall ASA and Secure FTD Software releases earlier than the first fixed release for their branch, when SSL VPN is reachable and secondary authentication is configured in the tunnel group scope. First fixed: ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1; FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1.
Observed exploitation: Active exploitation reported by Cisco PSIRT (October 2026) and listed in the CISA KEV catalogue on 29 October 2026. No victims or attackers named. Ransomware use unknown.
Recommended next action: Check whether SSL remote access VPN and secondary authentication are configured, then upgrade to a fixed release. Use the secondary authentication mitigation only as a short-term stopgap.
Identifiers: CVE-2026-76418
If your Cisco ASA or Secure Firewall Threat Defense (FTD) firewall offers SSL remote access VPN and any tunnel group uses secondary authentication, an unauthenticated attacker on the internet can make it reload (CVE-2026-76418, CVSS 3.1 score 8.6). Cisco says the flaw is being exploited, and CISA added it to its Known Exploited Vulnerabilities catalogue on 29 October 2026. Upgrade to a fixed release as soon as you can. Cisco says no workaround fully addresses the flaw, but it describes a mitigation that removes secondary authentication from the affected tunnel groups. That mitigation weakens VPN security, so treat it as a short-term stopgap. Cisco describes a forced reload, not data theft or takeover.
At a glance (as of 30 October 2026)
Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 on 28 October 2026. It covers CVE-2026-76418, a high-severity denial-of-service flaw in the remote access SSL VPN service of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. The cause is a logic error when secondary authentication is configured on a tunnel group. A crafted request sent while connecting to the SSL VPN makes the device reload unexpectedly. The attacker needs no credentials.
Cisco says its Product Security Incident Response Team (PSIRT) became aware of active exploitation in October 2026. CISA added CVE-2026-76418 to its Known Exploited Vulnerabilities (KEV) catalogue on 29 October 2026, with a due date of 1 November 2026 for US federal agencies. Cisco has not named attackers, victims or the scale of attacks, and has not published indicators of compromise in the advisory we reviewed.
Your immediate action: work out whether you meet all three exposure conditions below, and if you do, schedule the upgrade now rather than at the next maintenance window. If you are not exposed today, note that adding secondary authentication or enabling SSL VPN later would change that.
Who should check
Cisco says a device is vulnerable only when all three of these are true. If any one is false, this particular flaw does not apply to that device, though the firmware may still be worth updating for other reasons.
The first condition is a vulnerable software release, meaning anything earlier than the first fixed release for its branch (listed further down). The second is that the SSL remote access VPN login service is reachable, which on an ASA means the running configuration contains the webvpn section with an enable line for at least one interface. The third is that secondary authentication is set on a tunnel group. Secondary authentication is the second credential check some VPN profiles ask for, usually a second server group such as a one-time-password service.
Two details catch people out. If the tunnel group list is enabled, Cisco says to check every tunnel group, including the built-in DefaultWEBVPNGroup, and not only the profiles that appear on the login page. If the list is not enabled, DefaultWEBVPNGroup still matters, so turning the list off does not remove exposure on its own. On FTD, Cisco says a successful VPN login is not required to reach the vulnerable code.
The checks below only read configuration. They need administrator access to the device, and the commands shown are for an ASA command line. On FTD, Cisco points you to Devices > VPN > Remote Access in Firewall Management Center (FMC), or Remote Access VPN in Firewall Device Manager (FDM).
Cisco also lists Cloud-delivered Firewall, Cloud-delivered Firewall Management Center, Secure Access and Secure FMC Software as not vulnerable. Cisco offers a Software Checker tool linked from the advisory if you would rather confirm exposure by release and platform.
- Note the running software version, then compare it to the fixed-release table further down.
show version - Look for the webvpn section. If it contains an enable line naming an interface, SSL VPN login is reachable on that interface. Also note whether tunnel-group-list enable is present.
show running-config webvpn - Review the tunnel group configuration and look for secondary-authentication-server-group inside any tunnel group, including DefaultWEBVPNGroup. If you find it in a tunnel group that is in scope under the rules above, and conditions one and two are also true, treat the device as exposed.
show running-config tunnel-group
Understand the risk
The CVSS 3.1 base score is 8.6, and the vector (network reachable, low complexity, no privileges, no user interaction, availability impact high, no confidentiality or integrity impact) matches Cisco's description: a remote, unauthenticated crash. Cisco reports no code execution and no data exposure. CVSS describes severity, not likelihood, but here likelihood is also settled, because Cisco and CISA both say exploitation is happening.
For a firewall that terminates VPN, a reload is more than a nuisance. Remote users lose their sessions and anything routed through the box stops until it is back. Our judgement is that an attacker who can trigger this once can probably trigger it again, so a patched estate is the real fix and a single reload should not be written off as a glitch. The advisory does not say how an attack behaves over time, so that is inference rather than a vendor statement.
Cisco does not say how many devices are being targeted or whether the activity is opportunistic. Do not read the absence of detail as a sign that a quiet internet-facing device is safe.
What to do now
Upgrading is the answer. Cisco strongly recommends it and says no workarounds address the vulnerability. Plan the upgrade as you would any firewall change: a firewall upgrade reloads the device, so choose a window, check Cisco's upgrade guide for your platform and release path, and keep a copy of the current configuration. If your firewalls run as a high-availability pair, the platform upgrade guide covers the order and failover behaviour, so follow that rather than improvising.
If you cannot upgrade immediately, Cisco describes a mitigation that removes secondary authentication from the affected scope. It reduces exposure to this flaw but costs you a layer of VPN login security, and Cisco asks customers to evaluate it in their own environment first. There are two cases.
Case 1: DefaultWEBVPNGroup does not use secondary authentication. Cisco's mitigation is to disable the tunnel group list. Users will then need to know the correct connection profile name rather than choose it from a list. Run this in WebVPN configuration mode on an ASA, with administrator rights and an existing configuration copy so you can restore the list afterwards.
Case 2: DefaultWEBVPNGroup does use secondary authentication. Cisco's mitigation is to remove the setting from that group, which lowers the security of your remote access VPN. Enter the tunnel group in the mode where secondary-authentication-server-group appears in your running configuration, then remove it. This will change how users log in, so tell them first. Because you may be removing a second factor or second password check, we would only do this if the device is internet-reachable, cannot be upgraded soon, and compensating controls exist, such as restricting who can reach the VPN address at all. That last point is our engineering judgement, not a Cisco instruction.
Whichever route you take, treat the mitigation as temporary. Restore the configuration after the upgrade if the business needs it, and confirm in your change record who owns that.
- Back up the current configuration and check Cisco's upgrade guide for your platform and release path.
- Choose the first fixed release for your branch from the table in the next section, and schedule the upgrade. Expect the device to reload, so plan around remote users and any failover design.
- If the upgrade must wait, decide whether Case 1 or Case 2 applies and apply the matching mitigation in a controlled change, telling VPN users what will change. Cisco's advisory is the reference for the exact configuration.
webvpn no tunnel-group-list enable - After the upgrade, confirm the new version and re-check the exposure conditions from the previous section.
show version
Fixed releases
These are the first fixed releases listed by Cisco in advisory version 1.0, dated 28 October 2026. Move to the first fixed release or any later release on the same branch, and check Cisco's advisory and Software Checker before committing to a version for your hardware, because availability can vary by platform.
The listing is a vendor statement of fix availability, not a statement that your devices are patched. A patch also does not undo an earlier compromise. Cisco reports a crash, not intrusion, but if you have unexplained reloads, check device uptime in the show version output against what you expect.
- ASA 9.16 and earlier: 9.16.4.104
- ASA 9.18: 9.18.4.96
- ASA 9.20: 9.20.4.50
- ASA 9.22: 9.22.3.200
- ASA 9.23: 9.23.1.48
- ASA 9.24: 9.24.1.27 and 9.24.10.1
- FTD 7.0 and earlier: 7.0.11
- FTD 7.2: 7.2.13
- FTD 7.4: 7.4.9
- FTD 7.6: 7.6.7
- FTD 7.7: 7.7.14
- FTD 10.0: 10.0.3
- FTD 10.1: 10.1.1
What we know about real-world exploitation
Two authorities say this flaw is being exploited: Cisco PSIRT in its advisory and CISA through the KEV listing. KEV lists the flaw's use in ransomware campaigns as unknown. Neither source names a victim or attacker. We are not aware of any credible public report linking a named organisation to this CVE, and we will not speculate about one.
BleepingComputer reported on 29 October 2026 that Cisco gave no indicators of compromise. It also noted an earlier, separate denial-of-service flaw in ASA and FTD, CVE-2026-20349, which was exploited and patched in August 2026 and involves SSL listen sockets. The reporting does not say the two flaws share a cause, so do not assume that having fixed one has dealt with the other.
Update history
We’ll keep this page updated as new information becomes available. Check back for the latest developments.
Initial notice, 30 October 2026: Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 (version 1.0) on 28 October 2026 with fixed releases and a limited mitigation, and reported active exploitation. CISA added CVE-2026-76418 to KEV on 29 October 2026. Update source
Technical terms explained
- CVSS
- The Common Vulnerability Scoring System, a 0-10 measure of how severe a flaw is technically. It does not measure how likely an attack is.
- denial of service
- An attack that makes a system unavailable, here by forcing the firewall to reload, rather than by stealing data or taking control.
- Firewall Management Center
- Cisco's central management console for FTD firewalls, abbreviated FMC. Firewall Device Manager (FDM) is the on-device alternative.
- Known Exploited Vulnerabilities
- CISA's catalogue of vulnerabilities for which it holds evidence of exploitation in the wild. A listing means exploitation, not the identity of any victim.
- secondary authentication
- A second login check for a VPN profile, such as a second credential verified against a separate server group, on top of the first username and password check.
- tunnel group
- A Cisco ASA and FTD configuration object that defines how a type of VPN connection is authenticated and set up. DefaultWEBVPNGroup is the built-in one for SSL VPN.