Cisco patches actively exploited VPN flaw that can crash firewalls

Cisco has issued patches for a high‑severity flaw in Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software, tracked as CVE-2026-76418, which Cisco says has been actively exploited in the wild. The vulnerability affects the Remote Access SSL VPN service in ASA/FTD and stems from logic errors when secondary authentication is configured in a tunnel group.

An unauthenticated remote attacker could send a crafted request during VPN connection attempts, causing the affected device to reload and trigger a denial‑of‑service condition. Cisco first disclosed active exploitation in October 2026, though it did not provide detailed information on the attackers, timing, or scale of the campaigns.

Fixes are available across multiple release lines. For ASA Software, versions 9.16 and earlier are fixed in 9.16.4.104; 9.18 is fixed in 9.18.4.96; 9.20 in 9.20.4.50; 9.22 in 9.22.3.200; 9.23 in 9.23.1[.]48; and 9.24 in 9.24.1[.]27 and 9.24.10[.]1. For FTD Software, releases 7.0 and earlier are fixed in 7.0.11; 7.2 in 7.2.13; 7.4 in 7.4.9; 7.6 in 7.6.7; 7.7 in 7.7.14; 10.0 in 10.0.3; and 10.1 in 10.1.1.

Cisco also notes three conditions under which devices remain affected: running a vulnerable ASA or FTD release, having the SSL remote access VPN login service reachable, and having secondary authentication configured in the tunnel group scope. In the advisory, Cisco recommends checking all tunnel groups for secondary-authentication-server-group when tunnel-group-list enable is configured, including the default group DefaultWEBVPNGroup, and vice versa if the group list is absent or removed.

As temporary mitigations, Cisco suggests turning off the tunnel group list if DefaultWEBVPNGroup does not use secondary authentication, or disabling secondary authentication on any user-configured tunnel group list or the default group. For FTD, administrators should review the deployed remote access VPN policy and the device’s running configuration in Cisco Secure FMC or Cisco Secure FDM, noting that a successful VPN login is not required to reach the affected processing path.