Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls

Cisco patched CVE-2026-76418 in Secure Firewall ASA Software and Secure Firewall Threat Defense Software. The flaw affects the Remote Access SSL VPN service. It is high severity because an attacker does not need an account to target the service remotely.

The key mechanism is a crafted request sent while connecting to the SSL remote-access VPN. When secondary authentication is configured on a tunnel group, logic errors can send the device down a faulty processing path. The device then reloads unexpectedly. A successful attack therefore creates a denial-of-service condition rather than granting the attacker access.

Cisco said it learned of active exploitation in October 2026 and released fixes across supported ASA and FTD releases. Customers should identify exposed tunnel groups, apply the matching software update, and use Cisco's temporary mitigations if immediate patching is impossible. The article does not identify the attackers or describe the campaign's scale.

A device is vulnerable when it runs an affected Cisco Secure Firewall ASA or FTD release, its SSL remote-access VPN login service is reachable, and secondary authentication is configured for a tunnel group. All three conditions matter. A vulnerable version alone does not establish exposure under Cisco's stated conditions.

For ASA, Cisco lists fixes for releases 9.16 and earlier, 9.18, 9.20, 9.22, 9.23, and 9.24. Fixed builds include 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1. For FTD, listed fixes span 7.0 and earlier through 10.1.

Administrators must check tunnel groups carefully. With tunnel-group-list enable, they should inspect every group, including DefaultWEBVPNGroup. Without it, the default group can still remain exposed if it uses secondary authentication.

A CVSS score of 8.6 falls in the high-severity range. It signals that the vulnerability can have serious consequences and may be relatively practical to exploit. In this case, Cisco says exploitation can cause an affected firewall to reload and create a denial-of-service condition.

CVSS, the Common Vulnerability Scoring System, combines factors such as whether authentication is needed, whether the attack is remote, how complex exploitation is, and what security properties are affected. The article describes CVE-2026-76418 as exploitable by an unauthenticated remote attacker through a crafted SSL VPN request.

The score is not a prediction of how often attacks will occur or the total damage to a business. It is a standardized severity measure. Cisco's warning is especially urgent because the company said active exploitation began by October 2026, making real-world activity an important additional concern.

A firewall reload interrupts the device's normal work. If reloads happen repeatedly, the remote-access VPN may become unreliable or unavailable. Users outside the organization can lose their connection, fail to establish a new session, or be disconnected when the device restarts.

The article directly identifies the result as a denial-of-service condition. In practical terms, that can block remote staff from reaching internal resources that depend on the VPN. It can also create recovery work for network teams and interrupt services routed through the affected firewall. These operational effects are established consequences of a firewall becoming unavailable.

The article does not quantify outages, affected customers, or business losses. It does state that the vulnerability was exploited in the wild. Organizations should therefore patch affected releases, review exposure conditions, and use Cisco's listed mitigations while updates are pending.

Remote-access VPN services process connection requests before a user has completed the entire login process. Cisco says this flaw is triggered by a crafted request sent when connecting to the SSL remote-access VPN. That makes the vulnerable processing path reachable from the exposed service itself.

The important mechanism is the interaction between the request and tunnel-group settings. Logic errors occur when secondary authentication is configured on a tunnel group. The device can process the crafted request incorrectly and reload. Cisco explicitly states that a successful VPN login is not required to reach the affected processing path.

This means authentication does not provide sufficient protection against the attack. A reachable SSL VPN service can be exposed even when attackers lack valid credentials. Administrators should review the relevant ASA or FTD configuration, patch the software, and apply Cisco's temporary defenses where necessary.

Cisco recommends temporary configuration changes for customers who cannot immediately install a fixed release. If DefaultWEBVPNGroup does not use secondary authentication, customers can turn off the tunnel group list. This reduces exposure under the condition Cisco specifies.

Customers can also disable secondary authentication on any user-configured tunnel group list or on the default tunnel group, DefaultWEBVPNGroup. Administrators should first review the actual configuration, because the correct mitigation depends on which groups use secondary authentication. On FTD, Cisco says to review the deployed remote-access VPN policy and resulting device configuration in Secure FMC or Secure FDM.

These are temporary defenses, not replacements for patching. Cisco warns that removing tunnel-group-list enable does not eliminate exposure when DefaultWEBVPNGroup still uses secondary authentication. The company also says a successful VPN login is unnecessary, so simply requiring users to authenticate does not address the vulnerable path.

In general, a remote-access VPN creates an encrypted connection between an off-site user and an organization's private network. It lets that user reach permitted internal resources through a remote service. Cisco's article focuses on the SSL remote-access VPN login service running on ASA and FTD firewalls.

Secondary authentication is an additional verification step beyond the primary login. A tunnel group is a configuration container that defines settings for a class of VPN connections, such as authentication behavior. Together, they determine which authentication services and connection rules apply when a user connects. Cisco says the flaw appears when secondary authentication is configured in a tunnel group.

The vulnerability shows why these settings matter before login completes. Cisco says a crafted request can reach the affected processing path without a successful VPN login. Administrators must therefore inspect every relevant tunnel group, including DefaultWEBVPNGroup, and update or mitigate affected configurations.