Cisco is warning that attackers are exploiting a new zero-day vulnerability in its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software to remotely crash firewalls that run remote access SSL VPN. The flaw, tracked as CVE-2026-76418, lets an unauthenticated attacker force an affected device to reload, cutting off VPN access and any traffic the firewall protects while it restarts.
Cisco published its security advisory on October 28, 2026 at 19:15 GMT (3:15 PM ET) and said its Product Security Incident Response Team became aware of active exploitation earlier in October. Cisco has not said who is behind the attacks, which organizations were targeted or how many devices were hit, and it did not publish indicators of compromise.
Secondary authentication opens the door
The bug sits in the Remote Access SSL VPN service and is rated 8.6 (High) on CVSS 3.1, tracked under Cisco bug ID CSCwx26625. Cisco says it is caused by logic errors when secondary authentication is configured on a tunnel group. An attacker can trigger it by sending a crafted request while connecting to the SSL VPN, and does not need a successful login to reach the vulnerable code path.
A device is exposed when all 3 of these conditions are true:
- It runs a vulnerable release of ASA or FTD software.
- SSL remote access VPN is enabled on at least one interface (the running configuration contains
webvpnandenable <interface_name>). - Secondary authentication (
secondary-authentication-server-group) is set on a tunnel group, including the defaultDefaultWEBVPNGroup.
Cisco notes that disabling the tunnel group list does not remove exposure if the default group still uses secondary authentication. The company says Cloud-delivered Firewall, Cloud-delivered Firewall Management Center, Secure Access and Secure Firewall Management Center software are not affected. The flaw was found by Eric Fernald while resolving a Cisco Technical Assistance Center support case.
Fixed releases and a stopgap mitigation
Cisco says there are no workarounds and strongly recommends upgrading. The first fixed releases are:
- ASA:
9.16.4.104(9.16 and earlier),9.18.4.96,9.20.4.50,9.22.3.200,9.23.1.48, and9.24.1.27or9.24.10.1. - FTD:
7.0.11(7.0 and earlier),7.2.13,7.4.9,7.6.7,7.7.14,10.0.3and10.1.1.
Admins who cannot patch right away can remove the trigger. If DefaultWEBVPNGroup does not use secondary authentication, Cisco says to run no tunnel-group-list enable in WebVPN configuration mode, which means users must know the correct connection profile instead of picking it from a list. If the default group does use secondary authentication, the mitigation is no secondary-authentication-server-group, which Cisco warns lowers the security posture of remote access VPN. FTD admins should check the deployed remote access VPN policy in Firewall Management Center or Firewall Device Manager.
Second exploited ASA VPN crash bug since August
This is the second actively exploited denial-of-service flaw in the same ASA and FTD VPN service in less than 3 months. On August 11, 2026, Cisco disclosed CVE-2026-20349, another 8.6-rated bug that let attackers crash firewalls with a crafted HTTP request to the SSL VPN service. CISA added that flaw to its Known Exploited Vulnerabilities catalog the same day.
Cisco firewalls have been a repeat target. In September 2025, attackers exploited CVE-2025-20333 and CVE-2025-20362 as zero-days against ASA devices, prompting CISA’s Emergency Directive 25-03. Crash bugs like the new one do not give attackers code execution on their own, but they can knock remote workers offline, disrupt sites that depend on the firewall and force reboots that can mask other activity.
As of CISA’s latest catalog update on October 28, CVE-2026-76418 had not been added to the KEV catalog. Federal agencies will face a remediation deadline if and when it is listed.
VPN gateways remain one of the most common entry points in recent attacks, from the Check Point VPN zero-day linked to Qilin activity to Qilin ransomware attacks exploiting a PAN-OS VPN bypass. Organizations running ASA or FTD remote access VPN should patch, review logs for unexpected reloads and check whether secondary authentication is enabled on any tunnel group.
