Cisco Secure Firewall ASA and FTD CVE-2026-76418: Exploited SSL VPN DoS Flaw Added to CISA KEV

TL;DR: Cisco says attackers are actively exploiting CVE-2026-76418, a flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software. An unauthenticated, remote attacker can send a crafted request to the SSL VPN login and make the firewall reload, which is a denial of service (Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75). CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 29 October 2026, with a federal due date of 1 November 2026. Severity: High. Cisco scores it CVSS v3.1 8.6. What to do: check whether your SSL VPN uses secondary authentication on any tunnel group, and upgrade to Cisco's first fixed release for your software train.

What lowers the urgency for most readers:

• Crash, not takeover. Cisco describes the impact as the device reloading, "resulting in a denial of service (DoS) condition". Its CVSS vector rates confidentiality and integrity impact as None (C:N/I:N/A:H). Cisco does not describe remote code execution or access to data.
• Only one configuration is exposed. A device is affected only if it runs a vulnerable release, its SSL remote access VPN login is reachable, and secondary authentication is configured in the tunnel group scope Cisco describes. Firewalls without SSL VPN, or SSL VPN without secondary authentication, are not affected.
• Fixes are available for every ASA and FTD software train Cisco lists, and Cisco lists a tested mitigation for anyone who cannot upgrade straight away.
• Some Cisco products are confirmed not affected: Cloud-delivered Firewall, Cloud-delivered FMC, Secure Access and Secure FMC Software.

The catch: a firewall that reloads also drops every VPN session and, while it restarts, the traffic it protects. Cisco also notes that "a successful VPN login is not required to reach the affected processing path", so anyone who can reach the login page can try it.

Technical Information

Cisco's summary: "A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN."

• Cisco (CNA) CVSS v3.1: 8.6 High, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. Network attack, no privileges, no user interaction, availability impact only.
• Cisco Security Impact Rating: High.
• Weakness: CWE-690, unchecked return value to NULL pointer dereference (Cisco and CISA).
• Cisco bug ID: CSCwx26625.
• NVD: "Undergoing Analysis" with Cisco's score only. NVD has not published its own score.
• CISA SSVC (via NVD): Exploitation "active", Automatable "yes", Technical Impact "partial".
• Credit: Cisco says the flaw "was found by Eric Fernald during the resolution of a Cisco Technical Assistance Center (TAC) support case."

Exploitation status

Cisco's advisory says: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." Cisco has not published who is exploiting it, against whom, or how often, and we do not speculate. CISA lists known ransomware campaign use as "Unknown".

Timeline

All times in Cyprus time (UTC+2).

• October 2026: Cisco PSIRT becomes aware of active exploitation (no exact date given).
• 28 October 2026, 21:15: Cisco publishes advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 (version 1.0, Final). The CVE record goes live the same evening.
• 29 October 2026: CISA adds CVE-2026-76418 to KEV (CISA alert). The Canadian Centre for Cyber Security updates its advisory AV26-1102 to note the KEV listing.
• 1 November 2026: KEV due date for US federal civilian agencies.

CISA KEV status (live feed, catalogVersion 2026.10.29, checked 30 October 2026, 08:21 Cyprus time (UTC+2))

• Name: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
• Date added: 2026-10-29. Due date: 2026-11-01.
• Known ransomware campaign use: Unknown. Forensic triage: No.
• Required action: "Apply mitigations in accordance with vendor instructions", in line with BOD 26-04 (CISA BOD 26-04).

Affected Product Versions

Cisco says a device is affected only when all three of these are true:

1. It runs a vulnerable release of Cisco Secure Firewall ASA Software or Cisco Secure FTD Software (see the table below).
2. The SSL remote access VPN login service is reachable. On ASA, Cisco says the configuration is vulnerable if it contains the webvpn keyword and SSL VPN is enabled on at least one interface (webvpn / enable <interface_name>). On FTD, remote access VPN is enabled from Devices > VPN > Remote Access in Secure Firewall Management Center (FMC), or from Remote Access VPN in Secure Firewall Device Manager (FDM).
3. Secondary authentication is configured in the tunnel group scope:
   • If tunnel-group-list enable is configured, check all tunnel groups, including the default DefaultWEBVPNGroup, for secondary-authentication-server-group. Cisco notes the check "is not limited to profiles that are displayed in the group list on the login page."
   • If tunnel-group-list enable is absent, check DefaultWEBVPNGroup, because disabling the group list does not remove exposure when the default group uses secondary authentication.
   • On FTD, review the deployed remote access VPN policy and the resulting device running configuration in FMC or FDM.

First fixed releases (Cisco):

Confirmed not affected (Cisco): Cloud-delivered Firewall (CDFW), Cloud-delivered Firewall Management Center (cdFMC), Secure Access (CSA) and Secure FMC Software.

Cisco's Software Checker shows every advisory that applies to a given release and the "Combined First Fixed" release, which is worth using because ASA and FTD often carry several advisories at once.

Workaround and Mitigation

1. Upgrade. Cisco "strongly recommends" moving to a fixed release from the tables above, and considers any mitigation temporary. FTD upgrades follow the Secure FMC upgrade guides.
2. If you cannot upgrade yet, use Cisco's mitigation. Cisco says "there are no workarounds", but there is a mitigation: disable secondary authentication on any user-configured tunnel group list or on DefaultWEBVPNGroup.
   • Case 1: if DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel group list with no tunnel-group-list enable in WebVPN configuration mode. Users will then no longer pick a connection profile from a list and need to know the right one.
   • Case 2: if DefaultWEBVPNGroup does use secondary authentication, remove it with no secondary-authentication-server-group. Cisco warns that this lowers the security posture of the remote access VPN.
   • Cisco says the mitigation "was proven successful in a test environment" and that customers should test it in their own environment first.
3. Treat unexpected reloads as a signal. Because the visible effect is a reload, review crash and reload history on ASA and FTD devices that terminate SSL VPN, and open a TAC case for any unexplained reloads. Cisco has not said when exploitation began (Rescana guidance).
4. Reduce who can reach the login page. Where your setup allows, limit exposure of the SSL VPN portal while you patch (Rescana guidance).

Indicators of Compromise

Cisco has not published indicators of compromise, attack signatures or attacker infrastructure for CVE-2026-76418, and neither have CISA or the Canadian Centre for Cyber Security as of 30 October 2026, 08:21 Cyprus time (UTC+2). We have not published any either. The only observable effect Cisco describes is the device reloading unexpectedly after a crafted request to the SSL remote access VPN.

Cisco did not map the activity to MITRE ATT&CK techniques, and we have not done so.

Questions for your vendors

A supplier running ASA or FTD is not automatically exposed. It is worth asking (Rescana guidance):

• Do you terminate remote access VPN on Cisco Secure Firewall ASA or FTD, and is SSL VPN enabled?
• Is secondary authentication configured on any tunnel group, including DefaultWEBVPNGroup?
• Are those devices on Cisco's first fixed release, or have you applied Cisco's mitigation, and when?
• Have you seen unexplained firewall or VPN reloads in recent weeks?
• If your VPN goes down, what is your fallback for the services and access we depend on?

What we will update: We will update this post if Cisco revises the advisory or publishes indicators, if CISA changes the KEV entry (including the ransomware field), or if NVD publishes its own score.

Sources

• Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75, "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability" (v1.0, 28 Oct 2026): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75
• Cisco Software Checker: https://sec.cloudapps.cisco.com/security/center/softwarechecker.x
• CISA: Known Exploited Vulnerabilities catalog entry https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76418; alert, "CISA Adds Two Known Exploited Vulnerabilities to Catalog" (29 Oct 2026) https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog; BOD 26-04 https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
• CVE and NVD records: cve.org https://www.cve.org/CVERecord?id=CVE-2026-76418; NVD https://nvd.nist.gov/vuln/detail/CVE-2026-76418
• Canadian Centre for Cyber Security, Cisco security advisory AV26-1102, Update 1 (29 Oct 2026): https://www.cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-1102

Cisco ASA and FTD firewalls are the front door for remote access at many suppliers, managed service providers and outsourced IT teams. A flaw that lets anyone who can reach the VPN login page crash the firewall does not leak your data, but it can cut off the remote access, and the services behind it, that your business relies on from those suppliers. It is also hard to see from outside whether a supplier has secondary authentication switched on.

Forward this to your TPRM owner: If a critical supplier or MSP uses Cisco ASA or FTD for remote access VPN, ask them today whether they are on Cisco's fixed release or have applied Cisco's mitigation (Rescana guidance).

Want a fast, evidence-based view of which vendors in your supply chain are exposed to flaws like this, and how quickly they respond? Book a demo.