Cisco ASA and FTD VPN Flaw Exploited: CVE-2026-76418 Fixes

Short answer: Cisco has patched CVE-2026-76418, a bug in the SSL VPN service of its ASA and Firepower Threat Defense (FTD) firewalls that lets an attacker with no login crash and reload the device. Cisco says it is already being exploited. You are exposed if SSL VPN is turned on and any tunnel group uses secondary authentication. Upgrade to a fixed release now.

The key facts

• CVE: CVE-2026-76418 (Cisco bug ID CSCwx26625)
• Severity: CVSS 8.6, rated High
• Published: October 28, 2026
• Impact: an unauthenticated remote attacker can force the firewall to reload
• Exploited: yes, per Cisco
• Workaround: none, only a mitigation that weakens login security

Cisco's advisory says: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." It has not said who is behind the attacks or how widespread they are, and it has published no indicators of compromise.

A reload is not a breach, but on an edge firewall it still hurts. Every remote worker gets dropped, and traffic through the device stops until it comes back. If attackers keep sending the request, the outage repeats.

This is the second exploited ASA and FTD VPN crash bug in a few months. BleepingComputer notes that Cisco fixed a similar one, CVE-2026-20349, in August.

Step 1: check whether SSL VPN is enabled

On an ASA, look at the WebVPN settings:

show running-config webvpn

Cisco says you are in scope if you see webvpn with enable <interface_name> on at least one interface. On FTD, check Devices > VPN > Remote Access in Firewall Management Center (FMC), or Remote Access VPN in Firewall Device Manager (FDM).

Step 2: check tunnel groups for secondary authentication

Secondary authentication means users log in against two servers, for example a password server plus a second one. The bug sits in that code path.

show running-config tunnel-group

Look for secondary-authentication-server-group under any group. Cisco is specific about which groups count:

• If tunnel-group-list enable is set, check every tunnel group, including DefaultWEBVPNGroup, not only the ones on the login page.
• If the group list is turned off, still check DefaultWEBVPNGroup. Turning off the list does not remove that group's exposure.

If no group uses secondary authentication, Cisco does not list your setup as vulnerable. Patch anyway, because configurations change.

Step 3: upgrade to a fixed release

Find your current version with show version, then move to the first fixed release in your train. You can also use Cisco's Software Checker.

ASA release	First fixed	FTD release	First fixed
9.16 and earlier	9.16.4.104	7.0 and earlier	7.0.11
9.18	9.18.4.96	7.2	7.2.13
9.20	9.20.4.50	7.4	7.4.9
9.22	9.22.3.200	7.6	7.6.7
9.23	9.23.1.48	7.7	7.7.14
9.24	9.24.1.27 or 9.24.10.1	10.0	10.0.3
		10.1	10.1.1

Back up the running config first and schedule a window, since the upgrade reloads the device.

Step 4: use the mitigation only if you cannot patch yet

Cisco offers a stopgap that it tested in a lab:

• If DefaultWEBVPNGroup does not use secondary authentication, enter no tunnel-group-list enable in WebVPN configuration mode. Users then have to know their tunnel group name to connect.
• If DefaultWEBVPNGroup does use it, remove it with no secondary-authentication-server-group.

Cisco warns this "lowers the security posture for remote access VPN." Treat it as temporary and undo it after you upgrade.

Common mistakes

• Hiding the group list and assuming you are covered. DefaultWEBVPNGroup can still be exposed.
• Checking only the groups users can pick. Cisco says to check all of them.
• Calling it a takeover bug. Cisco describes a crash and reload, not code execution.
• Leaving the mitigation in place for good. It weakens login security, and the patch is the fix.
• Forgetting FTD. Firepower Threat Defense devices are affected too, not just ASA.