2026-10-29
Cisco ASA and FTD VPN flaw CVE-2026-76418: an unauthenticated attacker can reload the device (how to check, fixed releases)
On October 28, 2026 (UTC), Cisco disclosed CVE-2026-76418 (CVSS v3.1 8.6) in the remote access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD). An unauthenticated remote attacker can make the device reload unexpectedly, causing a denial of service. The cause is a logic error when secondary authentication is configured on a tunnel group (a VPN connection profile), triggered by a crafted request while connecting to the SSL VPN. The advisory describes no code execution or data leak. There is no workaround, and Cisco strongly recommends upgrading. Cisco PSIRT says it became aware of exploitation in October 2026 but gives no details. CISA's KEV list published at 19:00 UTC on October 28 does not include it. Our conclusion: if you expose SSL VPN on ASA or FTD, check whether any tunnel group uses secondary authentication and upgrade if so. Cisco's interim mitigations exist but lower security.