Cisco Patches Actively Exploited SSL VPN Vulnerability Affecting ASA and FTD Firewalls

Cisco has released security updates that address a critical vulnerability in the Remote Access SSL VPN service on its Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software. This vulnerability, tracked as CVE-2026-76418, lets unauthenticated attackers trigger unexpected device reloads, causing a denial of service.

The flaw is categorized as high severity, with a CVSS score of 8.6. Cisco published its advisory on October 28, 2026, after its Product Security Incident Response Team discovered active exploitation of this vulnerability earlier that month. The advisory does not disclose the identities of the attackers, the victims, or the scale of the campaigns involved.

Cisco SSL VPN Vulnerability

The vulnerability stems from logic errors when secondary authentication is configured on a VPN tunnel group. An attacker can send a crafted request while connecting to the SSL remote access VPN, reaching the vulnerable processing path without completing a successful login.

Successful exploitation causes the affected firewall to reload. Cisco describes an availability impact, not remote code execution or data theft. Eric Fernald discovered the issue while resolving a Cisco Technical Assistance Center support case.

The disclosure follows earlier active exploitation of Cisco ASA and FTD vulnerabilities. However, administrators should distinguish this authentication-free denial-of-service flaw from previously reported vulnerabilities requiring valid VPN credentials.

Exposure requires vulnerable software, a reachable SSL VPN login service, and secondary authentication within the relevant tunnel-group configuration. Administrators should inspect configurations for webvpn with enable <interface_name>, then examine secondary authentication settings.

When tunnel-group-list enable is present, every tunnel group requires inspection, including DefaultWEBVPNGroup and profiles absent from the login-page list. If the list is disabled, the default group remains relevant: secondary authentication there can preserve exposure. FTD administrators should review deployed policies and resulting device configurations through FMC or FDM.

Cisco confirms that Cloud-delivered Firewall, Cloud-delivered Firewall Management Center, Secure Access, and Secure FMC Software are unaffected. Earlier Cisco SSL VPN denial-of-service reporting concerned a separate session-handling vulnerability, not this tunnel-group logic error.

ASA fixes include 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and the listed 9.24 releases 9.24.1.27 and 9.24.10.1. FTD fixes include 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1.

Cisco lists no workaround but describes temporary mitigations. Where the default group lacks secondary authentication, administrators can turn off the tunnel-group list using no tunnel-group-list enable. Where the default group uses it, removing secondary authentication with no secondary-authentication-server-group lowers VPN security posture.

These changes require deployment-specific evaluation and do not replace patching. Cisco strongly recommends upgrading to an appropriate fixed release and using its Software Checker to confirm exposure and identify applicable updates before scheduling firewall maintenance.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.