Menu
Breach value calculatorCalculator

Cisco ASA and FTD CVE-2026-76418: Is Your Firewall Affected?

CVE-2026-76418 lets an outsider reload Cisco ASA and FTD firewalls via the SSL VPN. Who is affected, fixed releases, mitigation, and CISA's 1 Nov date.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

10 min read

CVE-2026-76418 lets an unauthenticated outsider force a Cisco ASA or FTD firewall to reload. It only affects devices running the SSL remote access VPN with secondary authentication set on a tunnel group. Cisco says it is being exploited. Upgrade to a fixed release; there is no workaround, only a temporary mitigation. CISA listed it as exploited on 29 October 2026.

Sources checked 30 October 2026.

A reload is an unplanned restart. While the firewall restarts, its remote access VPN is down and users are cut off. Repeat it, and an attacker can keep the device offline. That is a denial of service (DoS): the flaw does not, on Cisco's scoring, expose or change data.

This post answers one question: is your Cisco firewall affected, and what should you do this week? For why firewalls and VPN gateways attract attackers in the first place, see why edge devices get exploited. The full, daily-updated list of CISA's recent additions is on the latest exploited vulnerabilities page.

What is CVE-2026-76418?

It is a flaw in the Remote Access SSL VPN service of two Cisco firewall operating systems:

  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, the classic Cisco firewall software.
  • Cisco Secure Firewall Threat Defense (FTD) Software, the newer software, managed through Firewall Management Center (FMC) or Firewall Device Manager (FDM).

Cisco's advisory (ID cisco-sa-asaftd-tunnel-dos-s6mgkb75, first published 28 October 2026) puts the cause down to "logic errors when secondary authentication is configured on a tunnel group." CISA names it an "Unchecked Return Value to NULL Pointer Dereference Vulnerability." In plain terms, the software fails to check whether an internal step succeeded, then uses a reference that points at nothing, and the device crashes and restarts.

Secondary authentication means asking a VPN user for a second set of credentials, checked against a second server, on top of the first login. A tunnel group (Cisco also calls it a connection profile) is the set of VPN settings a user connects through.

CVE-2026-76418 is not the same flaw as CVE-2026-20349, a separate exploited denial of service in the same Remote Access SSL VPN service, which Cisco disclosed on 11 August 2026 and also rated 8.6.

Is your Cisco firewall affected?

Cisco says a device is vulnerable only when all three of these are true:

  1. It runs a vulnerable ASA or FTD release (see the fixed releases below).
  2. The SSL remote access VPN login service is reachable.
  3. Secondary authentication is configured in the tunnel group scope.

Cisco adds a point that is easy to miss: an attacker does not need a successful VPN login to reach the vulnerable code. If the VPN login page is reachable from the internet, so is the flaw.

Confirmed not vulnerable, per Cisco: Cloud-delivered Firewall, Cloud-delivered Firewall Management Center, Cisco Secure Access, and Secure Firewall Management Center (FMC) Software itself.

How severe is CVE-2026-76418?

On the 0-10 CVSS severity scale, Cisco, as the CVE assigner, rates this flaw 8.6 (High) under CVSS v3.1. As of 30 October, NVD's record carries only Cisco's score and shows the record as "Undergoing Analysis".

Field Value (source)
CVSS v3.1 8.6 High, AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H (Cisco)
Weakness CWE-690, unchecked return value to NULL pointer dereference (Cisco, CISA)
Cisco bug ID CSCwx26625 (Cisco)
Workarounds None (Cisco)
Exploited Yes: Cisco PSIRT, October 2026; CISA KEV, 29 October 2026

An 8.6 for a crash can look modest next to the 9s and 10s of remote code execution flaws. For a firewall, though, availability is the product. A VPN gateway that an outsider can restart at will is one your remote staff cannot rely on.

Which Cisco ASA and FTD releases fix CVE-2026-76418?

Cisco "strongly recommends" upgrading to a fixed release. These tables are copied from Cisco's advisory, version 1.0, as read on 30 October 2026.

ASA Software

Affected release First fixed release
9.16 and earlier 9.16.4.104
9.18 9.18.4.96
9.20 9.20.4.50
9.22 9.22.3.200
9.23 9.23.1.48
9.24 9.24.1.27; 9.24.10.1

FTD Software

Affected release First fixed release
7.0 and earlier 7.0.11
7.2 7.2.13
7.4 7.4.9
7.6 7.6.7
7.7 7.7.14
10.0 10.0.3
10.1 10.1.1

Two cautions. First, a release train that is not in these tables has no row in the advisory, so check it in Cisco's Software Checker rather than guessing. Second, the first release that fixes this flaw is not necessarily one that fixes every other ASA or FTD advisory. Cisco's Software Checker lists all the advisories that affect a given release and the earliest release that fixes them, so pick your target release there.

What should Cisco firewall owners do before 1 November?

Work through these in order. For a small organisation, the first four cover most of it.

  1. List your Cisco firewalls. Include ASA and FTD devices at branch offices, in the cloud and in standby pairs. Note the software release each one runs.
  2. Check whether each runs the SSL remote access VPN with secondary authentication on any tunnel group (the checks are in the deeper section below). If not, this flaw does not apply to that device, but still keep it on a supported, fixed release.
  3. Upgrade affected devices to a fixed release chosen in Software Checker. Internet-facing VPN gateways first.
  4. Record the evidence: the device, the release before and after, the date, and who did it.
  5. If you cannot upgrade straight away, apply Cisco's mitigation (below). Cisco treats mitigations as temporary and says to check that they suit your own environment before deploying them.
  6. Look back. Unexplained reloads of an affected device since October deserve a closer look and, if you have a support contract, a case with Cisco's Technical Assistance Center (TAC).

Is there a workaround for CVE-2026-76418?

There is no workaround; Cisco's only mitigation is disabling secondary authentication, which weakens VPN security. Use it only as a stopgap until the device runs a fixed release.

For the wider routine of handling an exploited flaw at short notice, see time to exploit and emergency patching.

What does CISA's KEV listing mean, and what doesn't it mean?

CISA's Known Exploited Vulnerabilities catalogue (KEV) lists flaws CISA has evidence are being exploited. Its 29 October alert added this Cisco flaw alongside a GitLab flaw, CVE-2026-97229.

What the listing tells you:

  • Exploitation is confirmed by CISA, matching Cisco's own statement: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability."
  • The due date is 1 November 2026, three days after the listing. Only US federal civilian agencies are required to meet it, under Binding Operational Directive (BOD) 26-04; other organisations should treat it as a sign of how urgent the fix is.
  • The required action is to apply mitigations per vendor instructions and follow BOD 26-04, or stop using the product if mitigations are unavailable. BOD 26-04 also has federal agencies work out whether an asset is publicly exposed, using CISA's Internet Exposure Reduction Guidance. Checking whether the affected device is reachable from the internet is a sensible first step for anyone.

What it does not tell you:

  • Who is exploiting it, or how widely. Neither Cisco nor CISA says. Known ransomware campaign use is "Unknown".
  • That your device was targeted. A KEV listing is about the flaw, not about your network.
  • That the attackers did more than crash devices. Nothing in Cisco's or CISA's entries says so, and this post doesn't speculate.

When was CVE-2026-76418 disclosed and added to KEV?

The public record for this flaw is short, and it moved quickly:

Date (2026) Event Source
October (day not given) Cisco PSIRT becomes aware of active exploitation Cisco advisory
28 October, 19:15 GMT Cisco publishes advisory 1.0 (Final), with fixed releases and no workaround Cisco advisory
28 October CVE record published in NVD NVD
29 October CISA adds it to KEV, due date 1 November CISA KEV and alert

From advisory to KEV listing took about a day. Cisco does not give the date it learned of the exploitation, or say whether that was before fixed releases existed. For Cisco firewalls specifically, this is not new. The edge devices post covers CISA's Emergency Directive 25-03 on ASA and FTD from September 2025.

Going deeper: for security and IT teams

Identifiers. CVE-2026-76418; Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 (version 1.0, Final, 28 October 2026); Cisco bug CSCwx26625; CWE-690. CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H: reachable over the network, low attack complexity, no privileges, no user interaction, scope changed, and impact on availability only. "Scope changed" means the impact reaches beyond the vulnerable component; Cisco describes the whole device reloading, not just the VPN service. NVD analysis is pending, so no NVD-assigned score exists yet.

Mechanism, at the level Cisco and CISA describe it. In the Remote Access SSL VPN login path, when secondary authentication is configured at tunnel group scope, a return value goes unchecked, and the code then dereferences a NULL pointer. The process faults and the device reloads. Cisco notes the code path is reachable before a VPN login succeeds, so the pre-authentication surface is the VPN portal itself.

Determine exposure on ASA. From Cisco's advisory: - SSL remote access VPN is in use if the running configuration contains webvpn with SSL VPN enabled on at least one interface (webvpn enable <interface_name>). - If tunnel-group-list enable is configured, check every tunnel group, including DefaultWEBVPNGroup, for secondary-authentication-server-group. Cisco says this applies even to connection profiles that are not shown on the login page. - If the group list is disabled or absent, check DefaultWEBVPNGroup only. So removing the group list does not remove exposure if the default group uses secondary authentication.

Determine exposure on FTD. Cisco's advisory says to review the deployed remote access VPN policy and the resulting device running configuration for the same settings. It notes that remote access VPN is enabled from Devices > VPN > Remote Access in FMC and from Remote Access VPN in FDM.

Mitigation, if you cannot upgrade yet. Cisco lists no workaround that fixes the flaw; its mitigation is to disable secondary authentication, in one of two ways: - DefaultWEBVPNGroup does not use secondary authentication: no tunnel-group-list enable. - DefaultWEBVPNGroup uses secondary authentication: remove it from that group with no secondary-authentication-server-group. Cisco warns this lowers the remote access VPN security posture, so weigh the loss of the second factor against the DoS risk, and time-box it.

Change-control both, confirm they suit your environment as Cisco advises, and treat them as temporary.

Detection and evidence. Cisco's advisory lists no indicators of compromise, syslog IDs or log signatures, and none are invented here. What you can collect: device reload history and crash information, uptime across the HA pair, VPN session drops in your monitoring, and alerting on any unscheduled reload of an internet-facing VPN gateway. The KEV entry marks forensic triage under BOD 26-04 as not required for this CVE, which fits a DoS flaw. That is not a reason to ignore an unexplained crash on a device that has had other ASA or FTD advisories.

Upgrade planning. Choose the target release in Software Checker against all current advisories, not just this one. Plan failover so an HA pair stays up during the upgrade. Before upgrading, check Cisco's Secure Firewall Threat Defense Compatibility Guide, which the advisory lists among its resources, for FMC and FTD version support.

Questions for your MSP or firewall vendor. Which ASA or FTD release does each of our devices run? Is SSL remote access VPN enabled, and does any tunnel group, including DefaultWEBVPNGroup, use secondary authentication? When will each device be on a release Software Checker shows as fixed for all current advisories? Have any of our devices reloaded unexpectedly since the start of October?

Key takeaways

  • CVE-2026-76418 lets an unauthenticated attacker reload Cisco ASA and FTD firewalls through the SSL remote access VPN, when secondary authentication is set on a tunnel group.
  • Cisco confirms active exploitation, rates it CVSS v3.1 8.6, and offers fixed releases but no workaround.
  • CISA listed it in KEV on 29 October 2026; the 1 November 2026 due date binds only US federal civilian agencies.
  • If you cannot upgrade today, Cisco's temporary mitigation disables the tunnel group list or secondary authentication, with trade-offs.
  • Choose the upgrade target in Cisco's Software Checker so it fixes other advisories too, and keep a before-and-after record.

Learn more

Sources

Spotted a mistake? Report a correction.