Cisco ASA and FTD SSL VPN denial of service actively exploited (CVE-2026-76418)

What happened

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software include a remote access SSL VPN service. A logic error in how that service handles secondary authentication on a tunnel group allows an unauthenticated, remote attacker to send a crafted request while connecting to the SSL VPN. A successful exploit causes the affected device to reload unexpectedly, resulting in a denial of service.

According to the CVSS vector, the flaw is reachable over the network, requires low attack complexity and no privileges or user interaction, and has a high availability impact with no confidentiality or integrity impact. Cisco PSIRT says it became aware of active exploitation of this vulnerability in October 2026 and strongly recommends upgrading to a fixed software release.

Who is affected

Affected versions are Cisco Secure Firewall ASA Software 9.16.1, 9.16.1.28, 9.16.2, 9.16.2.3, 9.16.2.7, 9.16.2.11, 9.16.2.13 and 9.16.2.14, and Cisco Secure Firewall FTD Software 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.2.0, 7.0.2.1 and 7.0.3. These products are firewall platforms that can terminate remote access SSL VPN connections. The vulnerability is specific to deployments where remote access SSL VPN is enabled and secondary authentication is configured on a tunnel group.

What to do now

1. Upgrade to the fixed software release identified in Cisco's advisory as soon as possible. Cisco states that it became aware of active exploitation in October 2026 and strongly recommends upgrading.
2. If you cannot upgrade immediately, apply Cisco's mitigation. Cisco notes there are no workarounds that address the vulnerability.
3. Determine whether the default tunnel group DefaultWEBVPNGroup uses secondary authentication.
4. If it does not, disable the tunnel group list in WebVPN configuration mode with the command no tunnel-group-list enable. Users will no longer be able to choose a connection profile from a list and must know the correct profile name.
5. If it does use secondary authentication, remove it from the group with the command no secondary-authentication-server-group. Cisco says this lowers the security posture of remote access VPN.
6. Test the chosen mitigation in your environment. Cisco says it has been deployed and proven successful in a test environment, but customers should determine its applicability and effectiveness.

How to detect it

Cisco has not published specific indicators of compromise for this CVE. Monitor ASA and FTD devices that terminate remote access SSL VPN for unexpected or unscheduled reloads, particularly where secondary authentication is configured on a tunnel group. An unscheduled reload during VPN connection attempts is the main visible symptom described by Cisco.

Beyond the patch

Because Cisco says this flaw is already being exploited, detection and response are the priority while you patch. Managed Detection & Response (MDR) can monitor for unexpected reloads and follow-on activity on affected internet-facing appliances. The flaw is reachable over the network with no credentials or user interaction, so it also belongs in your exposure review: Virtual CISO Services (vCISO) can help confirm which SSL VPN endpoints are in scope, whether the mitigation is applied, and that the fixed release is scheduled.