Cisco Secure Firewall ASA and FTD SSL VPN denial of service under active exploitation (CVE-2026-76418)

What happened

An unauthenticated, remote attacker can trigger an unexpected reload of Cisco ASA or FTD appliances running the remote access SSL VPN service when secondary authentication is configured on a tunnel group. The vulnerability is a logic error in the SSL VPN handling of crafted connection requests; a successful exploit causes the device to reload and drops the VPN, resulting in a denial-of-service condition. The CVSS 3.1 score is 8.6 (High), with network attack vector, low complexity, no privileges and no user interaction.

CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 29 October 2026. ENISA's EUVD lists it as exploited since 29 October 2026, and Cisco PSIRT states it became aware of active exploitation in October 2026. There is no ransomware association in the KEV record.

Who is affected

This affects Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software when remote access SSL VPN is configured with secondary authentication on a tunnel group. Cisco lists the following versions as affected: ASA Software 9.16.1, 9.16.1.28, 9.16.2, 9.16.2.3, 9.16.2.7, 9.16.2.11, 9.16.2.13 and 9.16.2.14; FTD Software 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.0.2.1, 7.0.3 and 7.2.0. These are perimeter firewall and VPN termination points; deployments that do not use remote access SSL VPN with secondary authentication are not exposed to the vulnerable path.

What to do now

1. Apply the fixed software release Cisco provides. Upgrade your ASA or FTD devices to the fixed release that matches your train, as described in Cisco's advisory.
2. If you cannot patch immediately, apply Cisco's mitigation: disable secondary authentication. If DefaultWEBVPNGroup does not use secondary authentication, run no tunnel-group-list enable in WebVPN configuration mode; users will no longer be able to choose a connection profile from a list. If DefaultWEBVPNGroup does use secondary authentication, run no secondary-authentication-server-group. Cisco notes that this lowers the security posture for remote access VPN.
3. Because this is actively exploited, restrict access to the remote access SSL VPN service where possible and monitor for unexpected device reloads.

How to detect it

Unexpected reloads on ASA or FTD appliances running remote access SSL VPN are the primary sign of this denial-of-service condition. Audit tunnel groups for secondary authentication to identify devices at risk. Repeated reloads without scheduled maintenance may indicate active exploitation attempts.

Beyond the patch

An actively exploited, unauthenticated denial-of-service flaw in a perimeter VPN service needs more than a patch cycle; detection and exposure control are part of the response. Managed Detection & Response (MDR) can monitor your ASA/FTD estate for unexpected reloads and follow up on active exploitation. Virtual CISO Services (vCISO) can help identify exposed remote access VPN profiles and prioritise containment before the next incident.