# Cisco ASA and FTD SSL VPN denial of service\: CVE\-2026\-76418

Canonical HTML: [Read this article on Rising](https://rising.dev/cybersecurity/cisco-asa-ftd-null/)

Cisco says CVE\-2026\-76418 could allow an unauthenticated attacker to reload an ASA or FTD firewall when its SSL VPN is reachable and a relevant tunnel group uses secondary authentication\. Cisco reports active exploitation\. Builds that fixed August's CVE\-2026\-20349 are affected by this flaw\.

Reviewed 1 Nov 2026 · Written by Rising from the linked sources. This is a dated snapshot, so check the official records before acting.

## What the flaw is

CVE\-2026\-76418 is in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense \(FTD\) software\. Cisco says an unauthenticated, remote attacker could send a crafted request while connecting to the VPN and make the device reload, which causes a denial of service\. The attacker needs no successful VPN login, and no user has to act\.

Cisco traces the flaw to logic errors when secondary authentication is configured on a tunnel group, also called a connection profile\. Its advisory labels the weakness CWE\-690, an unchecked return value that leads to a NULL pointer dereference, where software tries to use a missing value as a memory address\. CISA's catalog repeats that label\. Cisco has published no code\-level explanation\.

Denial of service is the only impact Cisco documents\. Cisco rates the flaw High, with a CVSS v3\.1 score of 8\.6 and the vector AV\:N\/AC\:L\/PR\:N\/UI\:N\/S\:C\/C\:N\/I\:N\/A\:H, which means no confidentiality or integrity impact and high availability impact\. The advisory does not state outright that other effects are impossible\. CISA's assessment in the CVE record rates technical impact as partial, a level its Binding Operational Directive 26\-04 defines to include denial of service\.

## Who is affected

All three of Cisco's conditions must hold\: the device runs a vulnerable ASA or FTD release, its SSL remote access VPN login service is reachable, and secondary authentication is configured in the relevant tunnel group\.

Cisco's machine\-readable advisory lists affected software on ASA 5500\-X, ASAv, Firepower 1000, 2100, 4100 and 9000, Secure Firewall 200, 1200, 3100, 4200 and 6100, Secure Firewall Threat Defense Virtual and 3000 Series Industrial Security Appliances\. Cloud\-delivered Firewall, Cloud\-delivered Firewall Management Center, Secure Access and Secure FMC Software are not affected, Cisco confirms\.

More than 51,000 Cisco ASA SSL VPN devices were exposed online by the count of Shadowserver, an internet monitoring organization, BleepingComputer reported on 29 October 2026\. The report gives no split of patched devices or honeypots\. That figure speaks to reachability, one of Cisco's three conditions\. It gives no count of devices using secondary authentication and no figure for FTD\.

## First fixed releases

Cisco's first fixed ASA releases are 9\.16\.4\.104 for 9\.16 and earlier, 9\.18\.4\.96 for 9\.18, 9\.20\.4\.50 for 9\.20, 9\.22\.3\.200 for 9\.22, 9\.23\.1\.48 for 9\.23, and 9\.24\.1\.27 or 9\.24\.10\.1 for 9\.24\.

Its first fixed FTD releases are 7\.0\.11 for 7\.0 and earlier, 7\.2\.13 for 7\.2, 7\.4\.9 for 7\.4, 7\.6\.7 for 7\.6, 7\.7\.14 for 7\.7, 10\.0\.3 for 10\.0 and 10\.1\.1 for 10\.1\.

A firewall patched only for CVE\-2026\-20349, the ASA and FTD VPN flaw Cisco disclosed on 11 August 2026, can still be exposed\. All 13 first fixed builds in that advisory, which Cisco updated on 16 September to point to hardening releases, appear in the affected list of the CVE record Cisco published for this flaw\. They include ASA 9\.23\.1\.47 and FTD 7\.6\.6\.

ASA 9\.19 and FTD 7\.3 have no row in Cisco's table, yet builds from both appear in that affected list\. The advisory does not state the support status of any train\. NVD's ranges for these two run up to 9\.20\.4\.50 and 7\.4\.9\.

The same affected list and Cisco's machine\-readable advisory include ASA 9\.18\.4\.135, 9\.20\.4\.235, 9\.23\.1\.195 and 9\.24\.1\.155, each numbered above the first fixed release for its train\. Cisco does not explain these builds, so run the exact installed release through the Cisco Software Checker, which returns the earliest release that fixes it\.

Alert AV26\-1102 from Canada's Cyber Centre gives 9\.23\.1\.4 for the 9\.23 line, while Cisco gives 9\.23\.1\.48 and its affected list includes 9\.23\.1\.7 through 9\.23\.1\.47\. NVD marks FTD 7\.6 as vulnerable through 7\.6\.7, while Cisco names 7\.6\.7 as first fixed and its affected list stops at 7\.6\.6\. Cisco says its security team validates only the release information in its own advisory\.

## What to check

Look in the running configuration for the webvpn keyword with SSL VPN enabled on at least one interface\. On FTD, remote access VPN is set under Devices \> VPN \> Remote Access in Secure Firewall Management Center, or under Remote Access VPN in Secure Firewall Device Manager\. Cisco says to review the deployed policy and the resulting device running configuration\.

If tunnel\-group\-list enable is configured, check every tunnel group, including DefaultWEBVPNGroup, for secondary\-authentication\-server\-group\. Cisco notes that the check covers profiles missing from the group list on the login page\.

If tunnel\-group\-list enable is absent or was removed, check DefaultWEBVPNGroup for the same setting\. Turning the list off leaves the device exposed when the default group uses secondary authentication\.

Cisco's advisory, still at version 1\.0 on 1 November 2026, gives no indicators, log messages or detection signature for this CVE\. Rescana, which sells third\-party risk services, says that as of 30 October CISA and Canada's Cyber Centre had published none either\.

Beazley Security, which sells security services, suggests three things to review on devices with SSL VPN and secondary authentication, for the period since October 2026\: unexpected reloads, crash data and gaps in syslog\. Authentication logs may miss attempts, it warns, since the flaw needs no login\. SOC Prime, which sells detection products, says a restart alone is no proof that configuration files or credentials were taken, or that code ran\. CVE\-2026\-20349 causes the same kind of reload\.

## What to do

Upgrade to a fixed release\. For a device with several open advisories, the Software Checker also returns the earliest release that fixes all of them\. The advisory does not cover restarts or failover during the upgrade, and points to Cisco's ASA and FMC upgrade guides\. Check the installed release and the deployed configuration afterwards\.

Cisco says no workaround addresses the flaw, and describes a mitigation it treats as temporary until an upgrade\. If DefaultWEBVPNGroup does not use secondary authentication, enter the command no tunnel\-group\-list enable in WebVPN configuration mode\. Users then have to know their connection profile, because the login page no longer offers a list\.

If DefaultWEBVPNGroup uses secondary authentication, the command no secondary\-authentication\-server\-group removes it\. Cisco warns of a weaker security posture for remote access VPN\. It proved the mitigation in a test environment, and tells customers to judge its fit and effect in their own before deploying\.

Beazley also suggests narrowing network access to the SSL VPN login service, where operations allow\.

Cisco's advisory does not call for credential rotation or a rebuild\. CISA's catalog entry lists forensic triage as No, the step its directive describes as assessing whether a system is compromised\. Beazley recommends reviewing affected firewalls for signs of compromise\.

## Exploitation so far

Cisco says its product security team became aware of active exploitation in October 2026, and gives no day, target, scale or actor\. The advisory followed on 28 October at 19\:15 GMT, announcing fixed software, and the CVE record at 20\:05 UTC\. BleepingComputer and SecurityWeek call the flaw a zero\-day, a term Cisco does not use\. Cisco credits Eric Fernald with finding it during a Cisco Technical Assistance Center support case, and does not say whether that case involved an attack\.

CISA added the CVE to its Known Exploited Vulnerabilities catalog on 29 October 2026, with a 1 November deadline for US federal civilian agencies, and lists ransomware use as unknown\. Its assessment in the CVE record lists exploitation as active and the flaw as automatable\. FIRST's EPSS model, which estimates the probability of exploitation in the next 30 days, gave 0\.821 percent on 31 October, at the 57\.3 percentile\.

Neither Cisco's advisory nor CISA's catalog entry mentions a named campaign or chaining with another flaw\. SecurityWeek reports no clear answer on whether one actor is behind both this flaw and CVE\-2026\-20349, for which Cisco reported exploitation in August 2026 and gives a different cause, insufficient error checks on HTTP requests\.

BleepingComputer mentions the ArcaneDoor campaign only as history, for flaws from 2025 and 2024\. Cisco's ArcaneDoor event page, last updated on 24 April 2026, and CISA's Emergency Directive 25\-03, updated on 23 April 2026, predate this CVE's disclosure and do not mention it\.

Beazley said on 29 October that no public proof of concept was known\. SOC Prime said the same day that neither Cisco's advisory nor the reporting it read contains one\.

## What is not known

Cisco does not say how long a reload takes, whether repeated requests can keep a device down, or whether attackers used the reload alone or alongside other activity\.

## Official records

- [NVD record for CVE\-2026\-76418](https://nvd.nist.gov/vuln/detail/CVE-2026-76418)
- [CISA KEV entry for CVE\-2026\-76418](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76418) · [On Rising’s list](https://rising.dev/cybersecurity/#CVE-2026-76418)
- [Cisco advisory cisco\-sa\-asaftd\-tunnel\-dos\-s6mgkb75](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75)
- [Cisco machine\-readable advisory \(CSAF\)](https://sec.cloudapps.cisco.com/security/center/contentjson/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75/csaf/cisco-sa-asaftd-tunnel-dos-s6mgkb75.json)
- [CVE record for CVE\-2026\-76418 \(JSON\)](https://cveawg.mitre.org/api/cve/CVE-2026-76418)
- [Cisco Software Checker](https://sec.cloudapps.cisco.com/security/center/softwarechecker.x)
- [Cisco advisory for CVE\-2026\-20349](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF)
- [Cisco ArcaneDoor event page, version 2\.3](https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks)
- [CISA Emergency Directive 25\-03](https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices)
- [CISA Binding Operational Directive 26\-04](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk)
- [Canadian Centre for Cyber Security alert AV26\-1102](https://www.cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-1102)
- [FIRST EPSS](https://www.first.org/epss/)

## Further reading

- [SecurityWeek](https://www.securityweek.com/attackers-exploit-second-cisco-firewall-vpn-zero-day-since-august/): A short report that sets this flaw beside CVE\-2026\-20349 and says the actor question is open\.
- [BleepingComputer](https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/): Reports the Shadowserver count, with earlier Cisco firewall flaws as background\.
- [Beazley Security](https://labs.beazley.security/advisories/BSL-A1238): Beazley Security sells security services\. Its advisory lists the reload, crash and syslog signs to review\.
- [Rescana](https://www.rescana.com/post/cisco-secure-firewall-asa-ftd-cve-2026-76418-ssl-ra-vpn-dos-kev): Rescana sells third\-party risk services\. Its post gives a timed check for published indicators on 30 October\.
- [SOC Prime](https://socprime.com/blog/cve-2026-76418-cisco-secure-firewall-zero-day/): SOC Prime sells detection products\. Its post separates what a reload shows from what it does not\.