- Cisco says attackers are exploiting CVE-2026-76418, which lets an unauthenticated outsider make some ASA and FTD firewalls reload. Cisco has not said how widespread the attacks are.
- Per Cisco, a device is affected only if it runs a vulnerable release, has a reachable SSL VPN login and uses secondary authentication on a tunnel group.
- Cisco has released fixed software. Its mitigation can mean removing secondary authentication, which Cisco says lowers VPN security. Check configurations, including the default group, and plan the upgrade.
A login safeguard sits at the centre of this flaw
Many firms add a second sign-in step to remote access to make it safer. On vulnerable releases of certain Cisco firewalls, a logic error in how secondary authentication is handled on a tunnel group lets an outsider crash the device. Cisco tracks the flaw as CVE-2026-76418.
This is one bug, not a pattern. It does show how a protective setting can become part of the route an attacker takes. Exposure also needs a vulnerable release and a reachable SSL VPN login service.
What Cisco has said so far
Cisco published its advisory on October 28, 2026. It covers the VPN feature that lets remote users connect over SSL in two Cisco products. These are the firewall software known as ASA (Adaptive Security Appliance) and the Threat Defense software, FTD.
Cisco says an unauthenticated attacker on the network can make the device reload unexpectedly. That is a denial of service. The firewall stops doing its job while it restarts.
Cisco says it became aware of active exploitation in October 2026. It has not said how widespread the attacks are. The Hacker News describes the flaw as high-severity, rated 8.6 on CVSS. Per The Hacker News, Cisco gave no start date and named no attackers.
Cisco describes only a denial-of-service effect. The advisory does not say attackers can read data or take control of the device.
How the flaw works
The SSL VPN service is how staff reach company systems from outside the office. A tunnel group is a connection profile. It sets how a VPN user signs in.
Cisco traces the bug to faulty logic in how the device handles a second authentication step on a tunnel group. An attacker sends a crafted request while connecting to the VPN. The device then reloads.
Cisco says the affected processing path can be reached without a successful VPN login. The sender needs no account and no password. A reachable login service is enough, if the other conditions hold.
Cisco says a device is affected only if three things are true. It runs a vulnerable release. The SSL VPN login service is reachable. Secondary authentication is set in the tunnel group scope.
One detail is easy to miss. Cisco says the check covers every tunnel group, not only those shown on the login page. Hiding the group list does not remove exposure if the default group, DefaultWEBVPNGroup, uses secondary authentication. A team that checks only what users see could miss it.
Patching or weakening
Cisco says no workaround addresses the flaw. It describes one mitigation with two cases. If the default group does not rely on a second step, the mitigation is to switch off the group list. Users then must know their profile name. If the default group does rely on it, the second step must be removed.
Cisco says removing it lowers the security of remote access VPN. It does not describe the group-list case that way. Cisco calls mitigations temporary and strongly recommends upgrading. It also tells customers to assess the impact before deploying any mitigation. So the stopgap may mean weakening a login control to avoid a reboot.
Cisco lists a first fixed release for each software line. For ASA, examples are 9.18.4.96, 9.20.4.50 and 9.23.1.48. For FTD, examples are 7.2.13, 7.4.9 and 7.7.14. Cisco's Software Checker maps a running release to its first fixed one.
Cisco says its cloud-delivered Firewall, cloud-delivered Firewall Management Center, Secure Access and Secure FMC Software are not affected.
Questions to put to your network team
Start with exposure. Which firewalls run ASA or FTD with SSL VPN enabled on an interface? Does any tunnel group, including the default one, have a secondary authentication server group? For FTD, Cisco points teams to Secure FMC or Secure FDM to see which VPN policy was deployed and what configuration resulted.
Then ask about timing. Which fixed release applies to each device, and when can it be installed? If the upgrade must wait, who decides on the mitigation? If the default group uses a second step, that person is accepting weaker VPN security in return for less outage risk.
Finally, ask what happens if the VPN gateway reloads in the middle of a working day. Remote staff, contractors and partners could lose access at once. That advice is WebPulse's own, not Cisco's.
Cisco credits Eric Fernald with finding the flaw while resolving a Cisco Technical Assistance Center support case.
The takeaway is narrow. For this flaw, the setting to find is secondary authentication on any tunnel group, including the default group, even if it is not on the login page. Check it, then plan the upgrade.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Cisco.
