Cisco has released fixes for an actively exploited weakness in the SSL VPN service of its Secure Firewall ASA and FTD software. An unauthenticated attacker can force the firewall to reload, cutting off remote access.
On 28 October 2026 Cisco published a security advisory for CVE-2026-76418, a high-severity vulnerability (CVSS 8.6) in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Cisco says its product security team is aware of active exploitation.
The flaw comes from logic errors when secondary authentication is configured on a VPN tunnel group. A remote attacker who does not need a valid login can send a crafted request that makes the device reload. While the firewall restarts, VPN users and other traffic through the device are interrupted.
Who is affected
A device is exposed only when SSL VPN (webvpn) is enabled on at least one interface and secondary authentication is set on a tunnel group. Cisco advises checking every tunnel group, including the built-in DefaultWEBVPNGroup. Cisco lists its Cloud-delivered Firewall, cdFMC, Secure Access and Secure Firewall Management Center as not affected.
Fixes and temporary mitigation
Fixed releases are available across supported trains, for example ASA 9.18.4.96, 9.20.4.50 and 9.22.3.200, and FTD 7.2.13, 7.4.9 and 7.6.7. Cisco states there is no workaround. As a temporary measure it describes either disabling the tunnel group list (when the default group does not use secondary authentication) or removing secondary authentication, and it notes that the second option lowers VPN security. Cisco recommends upgrading.
This article summarizes and comments on the source above in our own words. NC Solution is not affiliated with the source; read the original for full details.