Cisco patches exploited ASA and FTD SSL VPN denial-of-service flaw
Cisco has released fixes for CVE-2026-76418, a high-severity vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. Rated 8.6 under CVSS, the flaw has been exploited in the wild and can allow an unauthenticated remote attacker to force an affected device to reload, creating a denial-of-service condition.
The issue sits in the Remote Access SSL VPN service. Cisco said logic errors arise when secondary authentication is configured on a tunnel group. An attacker can send a crafted request while connecting to the SSL remote access VPN; a successful VPN login is not required to reach the affected processing path.
Which deployments are exposed
Exposure requires a vulnerable ASA or FTD release, a reachable SSL remote access VPN login service, and secondary authentication configured within the tunnel-group scope. Cisco became aware of active exploitation in October 2026, but did not disclose when the attacks began, the actor responsible, or their scale.
Administrators must check configurations carefully. Where tunnel-group-list enable is present, Cisco says every tunnel group, including the default DefaultWEBVPNGroup, should be reviewed for secondary-authentication-server-group. Removing or disabling the group list does not eliminate exposure if DefaultWEBVPNGroup still uses secondary authentication.
This case adds to Cisco vulnerability and ClickFix attack chains because perimeter-device vulnerabilities can quickly become operational incidents when remote-access services are publicly reachable.
Fixed versions and temporary mitigations
Cisco has issued ASA fixes in 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1. The corresponding FTD fixes are 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1.
As an interim measure, Cisco recommends turning off the tunnel group list when DefaultWEBVPNGroup does not use secondary authentication. Customers can instead disable secondary authentication on user-configured tunnel group lists or on DefaultWEBVPNGroup. For FTD, Cisco advises reviewing both the deployed remote-access VPN policy and the resulting device running configuration in Cisco Secure Firewall Management Center (FMC) or Cisco Secure Firewall Device Manager (FDM).
Business implication
Teams operating ASA or FTD remote-access VPNs should inventory internet-reachable services, compare installed versions with Cisco's fixed releases, and validate tunnel-group authentication settings before relying on a change as a mitigation. Because the affected path can be reached before a successful login, patching and configuration verification should be treated as an availability priority.