Cisco ASA and FTD SSL VPN Remote Denial of Service Vulnerability (CVE-2026-76418)

Affected Vendors

Cisco

Affected Components

Secure Firewall Adaptive Security Appliance (ASA), Secure Firewall Threat Defense (FTD)

Published Date

2026-10-28

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Cisco ASA and FTD Software with Remote Access SSL VPN enabled and secondary authentication configured.

Impact

Unauthenticated remote attackers can trigger an unexpected device reload, leading to a complete Denial of Service (DoS) of VPN services.

Mitigation

Apply the latest security patches from Cisco immediately; review secondary authentication configurations if patching is delayed.

Affected Products & Version Scope

All versions of Cisco ASA and FTD software are affected if the Remote Access SSL VPN service is active and secondary authentication is configured on any tunnel group.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

The primary remediation is to upgrade to the fixed software versions provided by Cisco.

1. Patching (Recommended)

Upgrade ASA to versions 9.16.4.57, 9.18.4.22, 9.20.2.2, or later.
Upgrade FTD to versions 7.0.6.3, 7.2.5.1, 7.4.1.1, or later.

2. Temporary Workaround

If immediate patching is not feasible, consider disabling secondary authentication on the affected tunnel groups:

bash

# Example: Removing secondary authentication via CLI
ciscoasa(config)# tunnel-group <GROUP_NAME> general-attributes
ciscoasa(config-tunnel-general)# no secondary-authentication-server-group <SERVER_GROUP>

*Note: Disabling secondary authentication may impact your multi-factor authentication (MFA) posture. Ensure alternative security controls are in place.*

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active exploitation (CISA KEV) and high exploit probability (EPSS), prioritize the patching of all Cisco ASA/FTD edge devices immediately to prevent service disruption.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

This vulnerability exists in the Remote Access SSL VPN service of Cisco ASA and FTD software due to logic errors when processing connection requests for tunnel groups configured with secondary authentication. An unauthenticated attacker can exploit this by sending a crafted request during the SSL VPN handshake process. The flaw leads to a system crash and subsequent reload, resulting in a DoS condition. Given its inclusion in the CISA KEV catalog and a high EPSS score of 0.94, this vulnerability is actively being targeted by threat actors.

Official Vendor Advisories & References

NVD Original English Description

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75

Source: psirt@cisco.com · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76418

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: