Cisco ASA and FTD VPN flaw lets unauthenticated attackers crash firewalls

What happened

On October 28, 2026, Cisco published a security advisory for CVE-2026-76418, a flaw in Cisco Secure Firewall ASA (Adaptive Security Appliance) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The bug sits in the Remote Access SSL VPN service, the part your staff use to connect to the company network from home or on the road.

If secondary authentication is configured on a tunnel group, an attacker who has not logged in at all can send a specially crafted request while connecting to the VPN and make the firewall reload unexpectedly. Until the device comes back up, the VPN is down and other traffic through the firewall may be interrupted as well. Cisco rates the flaw as high severity and has already released fixes.

According to The Hacker News, Cisco said it became aware of active exploitation of this flaw in October 2026. Cisco did not say when the attacks started, who is behind them or how widespread they are. At the time of writing, neither the CISA KEV catalog nor the European EUVD database lists the flaw as exploited. We still recommend treating it as if it were being exploited.

Why it is dangerous

This is a CWE-690 type bug: at a certain point the software fails to check whether it got a valid result and carries on with an “empty” value, then falls over. Think of a security guard who is handed an empty envelope instead of an ID badge, has no idea what to do with it, and locks down the whole building. Cisco says the flaw is caused by logic errors when secondary authentication is configured on a tunnel group.

The attack works over the network, typically from the internet, because the VPN login page has to be reachable from outside. The attacker needs no password and no account. Cisco explicitly states that a successful VPN login is not required to reach the affected code.

It also matters what an attacker cannot get. Cisco describes only a denial of service (DoS). Its advisory says nothing about code execution, data theft or a firewall takeover, and the CVSS vector lists no impact on confidentiality or integrity. The impact can still hurt: every reload disconnects remote workers from the company network, and no traffic passes through the firewall until it comes back up.

The CVSS score is 8.6 out of 10 (high), assigned by Cisco itself under CVSS 3.1. It is high because the attack is simple, works over the network, needs no login and has a high impact on availability. EPSS, which estimates the chance of exploitation in the next 30 days, stood at only 0.57% as of October 29, 2026. The CISA KEV catalog, the US list of confirmed exploited vulnerabilities, does not include it yet. With reports of active exploitation, though, a low EPSS is no reason to wait.

Who is affected

This affects companies and organizations running a Cisco firewall with ASA or FTD software that provides remote access over SSL VPN. A device is only vulnerable if all three conditions are met:

it runs a vulnerable ASA or FTD release
the SSL VPN login service is reachable (the configuration contains webvpn and SSL VPN is enabled on at least one interface)
secondary authentication is configured in a tunnel group (secondary-authentication-server-group)

Vulnerable release trains are ASA 9.16 and earlier, 9.18, 9.20, 9.22, 9.23 and 9.24, and FTD 7.0 and earlier, 7.2, 7.4, 7.6, 7.7, 10.0 and 10.1, in each case before the first fixed release listed below.

Cisco has confirmed the flaw does not affect Cloud-delivered Firewall (CDFW), Cloud-delivered Firewall Management Center (cdFMC), Secure Access (CSA) or Secure FMC Software itself. If you do not use SSL VPN or have no secondary authentication configured, Cisco says your device is not vulnerable.

How to check if you are affected

All of the following commands only display information and change nothing. On ASA, log in to the CLI and check the software version:

show version

Check whether SSL VPN is enabled. Look for the webvpn section and an enable line with an interface name. The same output also shows whether tunnel-group-list enable is configured:

show running-config webvpn

Review your tunnel groups and look for secondary-authentication-server-group. If tunnel-group-list enable is configured, check every group including the default DefaultWEBVPNGroup, even those not shown on the login page. If it is not configured, check DefaultWEBVPNGroup, because disabling the group list does not remove the exposure.

show running-config tunnel-group

For FTD, check the version and the deployed remote access VPN policy in Cisco Secure FMC under Devices > VPN > Remote Access or in Cisco Secure FDM under Remote Access VPN. For a quick answer, enter your release number in the Cisco Software Checker, which tells you whether it is affected.

How to fix it

Cisco has released fixed software and strongly recommends upgrading. First fixed releases per train:

ASA 9.16 and earlier: 9.16.4.104
ASA 9.18: 9.18.4.96
ASA 9.20: 9.20.4.50
ASA 9.22: 9.22.3.200
ASA 9.23: 9.23.1.48
ASA 9.24: 9.24.1.27 or 9.24.10.1
FTD 7.0 and earlier: 7.0.11
FTD 7.2: 7.2.13, FTD 7.4: 7.4.9, FTD 7.6: 7.6.7
FTD 7.7: 7.7.14, FTD 10.0: 10.0.3, FTD 10.1: 10.1.1

Recommended steps:

Confirm your version and configuration as described in the previous section.
If you are affected, schedule the upgrade as soon as possible. The firewall reboots during the upgrade, so ideally do it outside business hours.
Back up the configuration and use the Cisco Software Checker to make sure the target release has no other known flaws.
Upgrade ASA following the Cisco Secure Firewall ASA Upgrade Guide, and FTD through Secure FMC following the relevant upgrade guide. For a failover pair, follow the failover procedure in the guide.
After upgrading, confirm the version with show version and test VPN connectivity.

Temporary measure: Cisco says there is no workaround but offers a mitigation. If DefaultWEBVPNGroup does not use secondary authentication, disable the group list with no tunnel-group-list enable in WebVPN configuration mode. Users will then no longer pick a profile from a list and must know the right one. If DefaultWEBVPNGroup does use it, remove secondary authentication with no secondary-authentication-server-group, which lowers the security of your VPN.

Cisco stresses that the mitigation should first be evaluated in your own environment and is only a stopgap. So the right order is: check exposure, upgrade, and use the mitigation only if you cannot upgrade right away.

What if you may already be compromised

Since Cisco says the flaw “only” causes a device reload, being hit here mainly means someone has crashed your firewall. Neither Cisco nor The Hacker News has published specific indicators of attack.

What to look at:

uptime in the output of show version, which reveals a recent reload
crash records via show crashinfo
syslog and monitoring: unexpected VPN or internet outages in recent weeks
user reports of sudden VPN disconnects

If you find unexplained reboots, especially repeated ones, save the logs and crashinfo output and open a case with Cisco TAC or your reseller. For this flaw, Cisco describes only a device reload, not a takeover. Repeated attacks on your VPN may still be part of wider activity. If in doubt, bring in a security professional.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.