Audience: administrators of Cisco Secure Firewall ASA and FTD that expose SSL VPN to the internet. This page is based on Cisco's advisory, NVD and CISA's KEV list; it contains no attack steps or exploit code.
Developing: this page will be updated as more is published
As of October 29, 2026 (JST)Not yet known
- Who is being attacked and how widely (Cisco has not published details)
- A CISA KEV listing (not in the list published 19:00 UTC, October 28)
- NVD's own assessment (status: Received)
- A JPCERT/CC alert (none found)
Cisco published the advisory on October 28 (UTC) with fixed releases, as final version 1.0, and says it became aware of exploitation in October 2026.
What to do today
Check whether you expose SSL VPN
On ASA, look for webvpn in the running config with enable on at least one interface. On FTD, review the deployed remote access VPN policy in FMC or FDM and the resulting configuration. Cisco also makes reachability of the login service a condition.
Find tunnel groups with secondary authentication
Cisco tells you to look for secondary-authentication-server-group in tunnel groups. If tunnel-group-list enable is configured, check every group, including those not shown on the login page. If it is not, check DefaultWEBVPNGroup: removing the group list does not remove exposure if the default group uses secondary authentication. A successful VPN login is not needed to reach the affected code.
Upgrade to a fixed release
Move to at least the release in the table below. Cisco Software Checker can confirm whether your release is affected. If you upgraded in August for CVE-2026-20349, note that this advisory's fixed releases are newer, so you may need to upgrade again.
Decide on an interim mitigation if you cannot upgrade yet
If DefaultWEBVPNGroup does not use secondary authentication, no tunnel-group-list enable disables the group list; users then need to know their connection profile name. If it does, no secondary-authentication-server-group removes it but lowers remote access security. Cisco calls both temporary and asks you to test first.
Monitor reloads and plan for VPN downtime
Look in your log monitoring or syslog alerts for reloads you cannot explain (our judgment). Decide today who makes the call, how remote staff are told, and which work stops if the VPN drops.
Fixed releases
| Product | Train | First fixed release |
|---|---|---|
| ASA | 9.16 and earlier | 9.16.4.104 |
| ASA | 9.18 | 9.18.4.96 |
| ASA | 9.20 | 9.20.4.50 |
| ASA | 9.22 | 9.22.3.200 |
| ASA | 9.23 | 9.23.1.48 |
| ASA | 9.24 | 9.24.1.27, 9.24.10.1 |
| FTD | 7.0 and earlier | 7.0.11 |
| FTD | 7.2 | 7.2.13 |
| FTD | 7.4 | 7.4.9 |
| FTD | 7.6 | 7.6.7 |
| FTD | 7.7 | 7.7.14 |
| FTD | 10.0 | 10.0.3 |
| FTD | 10.1 | 10.1.1 |
Cisco says Cloud-delivered Firewall, cdFMC, Secure Access and Secure FMC Software are not affected.
1. SSL VPN enabled
webvpn enabled on at least one interface
2. Login service reachable
Connectable from the internet or other networks
3. Secondary authentication set
secondary-authentication-server-group in a tunnel group
What was disclosed
- CVE
- CVE-2026-76418 (Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75, bug ID CSCwx26625)
- Type
- CWE-690. A logic error when secondary authentication is configured on a tunnel group
- Severity
- CVSS v3.1 8.6 (Cisco). Network, no authentication, no user interaction. Availability impact only
- Impact
- An unauthenticated remote attacker can make the device reload, causing a denial of service
- Disclosure
- October 28, 2026 (UTC), final version 1.0. Found during a Cisco TAC support case
- Exploitation
- Cisco PSIRT says it became aware of exploitation in October 2026; no details on who or how widely
- Workaround
- None. Interim mitigations are in step 4 above
NVD recorded the CVE the same day with status Received and only Cisco's score. Its record also includes a CISA coordinator assessment listing exploitation as "none" (October 28, around 22:45 UTC), which conflicts with Cisco's statement. Recheck later to see which reflects newer information.
How this relates to CVE-2026-20349 in August
The same SSL VPN service on ASA and FTD had CVE-2026-20349 (CVSS 8.6, a crafted HTTP request reloads the device) disclosed on August 11, with Cisco aware of exploitation and CISA adding it to KEV the same day. It is a different flaw with a different cause and condition (here, secondary authentication). Two points for defenders:
- Cisco says it has seen exploitation of two flaws that reload the same device class without login, disclosed about 2.5 months apart (August 11 and October 28). Plan for SSL VPN devices to restart
- The fixed releases differ, so a device patched in August may still be short. For ASA 9.18, August's fix is 9.18.4.94 and this one is 9.18.4.96
What is not yet known
| Item | Status |
|---|---|
| Actual exploitation | Cisco says it is aware; no details |
| KEV listing | Not in the list published 19:00 UTC, October 28 |
| NVD assessment | Received (Cisco's score only) |
| Japanese public-agency alert | None found in our check |
Sources
Checked on October 29, 2026.
- Cisco, "Cisco Secure Firewall ASA and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability" (cisco-sa-asaftd-tunnel-dos-s6mgkb75, October 28, 2026) — cisco.com
- NVD, CVE-2026-76418 — nvd.nist.gov
- CISA, Known Exploited Vulnerabilities Catalog — cisa.gov
- Cisco, "Cisco Secure Firewall ASA and FTD Software Remote Access SSL VPN Denial of Service Vulnerability" (cisco-sa-asaftd-vpn-dos-dzv4mQFF, CVE-2026-20349, August 11, 2026, updated September 16) — cisco.com
Update history
2026-10-29: First version, based on Cisco's advisory (October 28), NVD and CISA's KEV list.
Read next
- Defending VPN devices: How to defend VPN devices and remote access
- Exploited the same month: Exploited edge device vulnerabilities, mid-October 2026
- Prioritising fixes: How to decide which CVEs to fix first (CVSS, EPSS, KEV)
- Response steps: Vulnerability remediation playbook
- Terms: What is CVSS?