[CVE-2026-76418] Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls

Severity

High

Detail

Cisco has released security updates to address CVE-2026-76418, a high-severity vulnerability affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. Cisco confirmed that the vulnerability is being actively exploited in the wild.

The vulnerability exists in the SSL Remote Access VPN service and is caused by logic errors when secondary authentication is configured on a tunnel group. An unauthenticated remote attacker could exploit the flaw by sending a specially crafted request to an affected SSL VPN service. Successful exploitation could cause the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition.

According to Cisco Product Security Incident Response Team (PSIRT), evidence of active exploitation was identified during October 2026. While no indicators of compromise or attribution details have been released, organizations are strongly advised to apply vendor-provided updates immediately

CVE ID	Summary	CVSS Score
CVE-2026-76418	A denial-of-service vulnerability in Cisco ASA and FTD SSL VPN services that could allow an unauthenticated remote attacker to cause affected devices to reload unexpectedly through crafted requests.	8.6 (High)

Affected Products

The vulnerability affects:

Cisco Secure Firewall ASA Software
Cisco Secure Firewall FTD Software

Recommendation

Organizations should implement the following measures immediately:

Upgrade affected Cisco ASA and Cisco FTD devices to the recommended fixed releases.
Identify all internet-facing SSL VPN gateways and prioritize remediation.
Review VPN and firewall logs for signs of repeated connection failures or unexpected device reloads.
Monitor VPN services for suspicious traffic patterns targeting SSL remote access functionality.
If immediate patching is not possible, disable secondary authentication on affected tunnel groups, including DefaultWEBVPNGroup, where operationally feasible.

Source