Attackers Exploit Cisco Firewall Flaw to Crash SSL VPN Devices

Cisco says attackers are actively exploiting CVE-2026-76418, a high-severity flaw in Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software. The company’s security response team became aware of exploitation in October 2026. Scored 8.6 on CVSS v3.1, the vulnerability can let a remote attacker cause affected devices to reload, disrupting remote-access VPN service. Cisco has not reported a public proof-of-concept exploit.

The flaw stems from logic errors in the Remote Access SSL VPN service when secondary authentication is configured on a tunnel group. An attacker can send a crafted connection request; Cisco says a successful VPN login is not required to reach the vulnerable processing path. Exposure requires `webvpn` to be enabled on at least one interface and a secondary authentication server group to be configured on a tunnel group or `DefaultWEBVPNGroup`.

Researcher Eric Fernald identified the issue while working on a Cisco TAC support case. Cisco lists affected ASA releases from 9.16 through 9.24 and FTD releases from 7.0 through 10.1 when configured with SSL VPN secondary authentication.

Cisco has fixed the issue in ASA versions 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1[.]27 and 9.24.10[.]1, and FTD versions 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. Cisco says there is no complete workaround, but administrators can mitigate the flaw by disabling secondary authentication on affected tunnel groups or the default group until they can install an update.