CVE-2026-76418: Cisco Secure Firewall SSL VPN DoS
Active exploitation confirmed in CISA KEV.
Active exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-10-29. Federal agencies must patch by 2026-11-01.
TL;DR - CVE-2026-76418 is an unauthenticated, remotely exploitable denial-of-service vulnerability in Cisco Secure Firewall ASA and FTD Remote Access SSL VPN. - Affected systems can reload when secondary authentication is configured on a tunnel group. - Exploitation is confirmed in the wild, the CVE is in CISA KEV, and remediation is due by November 1, 2026.
Summary
CVE-2026-76418 is a Cisco Secure Firewall vulnerability affecting the Remote Access SSL VPN service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. A remote attacker does not need valid credentials or user interaction to send a crafted request to a vulnerable SSL VPN endpoint. Under the affected configuration, successful exploitation can cause the firewall to reload and disrupt network connectivity.
The vulnerability has a CVSS 3.1 base score of 8.6 High. Its operational risk is higher than the score alone may suggest because CISA lists it in the Known Exploited Vulnerabilities catalog. CISA added the CVE on October 29, 2026, with a remediation deadline of November 1, 2026. Cisco’s Product Security Incident Response Team also reported awareness of active exploitation in October 2026.
| Field | Details |
|---|---|
| CVE ID | CVE-2026-76418 |
| Affected vendor | Cisco |
| Affected products | Cisco Secure Firewall ASA Software and Cisco Secure Firewall FTD Software |
| CVSS | 8.6 High |
| Attack vector | Network |
| Attack complexity | Low |
| Authentication required | None |
| User interaction | None |
| Primary impact | Availability through unexpected firewall reload |
| Patch available | Yes |
| Effective workaround | None reported by Cisco |
| CISA KEV status | Listed |
| CISA remediation deadline | November 1, 2026 |
The available advisories describe denial of service as the demonstrated impact. They do not indicate arbitrary code execution, authentication bypass, data disclosure, or unauthorized configuration changes. Repeated firewall reloads can still interrupt remote access, site-to-site connectivity, inspection, and other services that depend on the affected device.
For background on related security concepts, see our explanation of DNS spoofing and guide to zero-day exploits.
Root Cause
Cisco describes the underlying issue as logic errors that occur when secondary authentication is configured on a tunnel group. CISA characterizes the weakness as an unchecked return value leading to a NULL-pointer dereference. In practical terms, a crafted request can drive the SSL VPN processing path into an invalid state that the software does not handle safely.
The failure occurs while an unauthenticated client is connecting to the Remote Access SSL VPN service. The vulnerable condition is configuration-dependent: the relevant tunnel group must have secondary authentication configured. That requirement can reduce the population of directly affected endpoints, but it should not be treated as a sufficient defense. Internet-facing VPN services remain attractive targets, and CISA’s KEV listing confirms that attackers are actively exploiting the vulnerability.
The public technical material does not provide a complete request sequence, memory state, or detailed code-level explanation. Defenders should not assume that the absence of a public exploit sample means the issue is difficult to exploit. The published attack characteristics are network reachable, low complexity, and unauthenticated.
Analyst’s Take: The immediate priority is to identify Internet-facing ASA and FTD devices that provide Remote Access SSL VPN and have secondary authentication configured. A public exploit sample is not necessary to justify action: CISA and Cisco have already confirmed active exploitation, while Cisco reports no effective workaround.
Who’s Exposed
The affected product families are Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software. Exposure is most relevant for systems providing Remote Access SSL VPN, particularly where secondary authentication is configured on a tunnel group.
For ASA Software, Cisco identifies the following affected release branches and first fixed releases:
| ASA software release branch | First fixed release |
|---|---|
| 9.16 and earlier | 9.16.4.104 |
| 9.18 | 9.18.4.96 |
| 9.20 | 9.20.4.50 |
| 9.22 | 9.22.3.200 |
| 9.23 | 9.23.1.48 |
| 9.24 | 9.24.1.27 and 9.24.10.1 |
For FTD Software, the identified fixed releases include:
| FTD software release branch | First fixed release |
|---|---|
| 7.0 and earlier | 7.0.11 |
| 7.2 | 7.2.13 |
| 7.4 | 7.4.9 |
| 7.6 | Consult Cisco’s advisory for the applicable fixed build |
Cisco’s advisory is authoritative for the complete FTD release matrix and for determining the correct upgrade path. The exact supported target can depend on the deployed appliance, management platform, current release, and upgrade constraints. Do not infer that a version number from another branch is an equivalent fix.
Inventory both directly Internet-facing firewalls and devices reachable through load balancers, NAT, reverse proxies, or upstream security infrastructure. A firewall may be exposed even when its management interface is restricted because the SSL VPN listener is a separate service path.
Severity Breakdown
The published CVSS vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
| Metric | Value | Operational meaning |
|---|---|---|
| Attack vector | Network (AV:N) | The attack can be delivered remotely over a network. |
| Attack complexity | Low (AC:L) | No unusual conditions beyond the vulnerable service and configuration are required. |
| Privileges required | None (PR:N) | The attacker does not need an account or authenticated VPN session. |
| User interaction | None (UI:N) | No victim action is required. |
| Scope | Changed (S:C) | The vulnerable component can affect availability beyond its immediate processing context. |
| Confidentiality | None (C:N) | No confidentiality loss is indicated. |
| Integrity | None (I:N) | No unauthorized data or configuration modification is indicated. |
| Availability | High (A:H) | Successful exploitation can cause the firewall to reload and interrupt services. |
The most important operational factors are network reachability, no authentication requirement, and high availability impact. A firewall reload can terminate active VPN sessions, interrupt traffic inspection, and create a temporary or repeated outage. For organizations that use Cisco firewalls as remote-access concentrators, the impact can extend to a substantial portion of the workforce.
The CVSS scope value does not mean that the advisory demonstrates compromise of protected hosts or arbitrary access to internal systems. The documented effect remains denial of service. Risk decisions should combine the score with Internet exposure, business dependency on the firewall, redundancy, monitoring coverage, and the confirmed exploitation status.
Exploitation Status
Exploitation in the wild is confirmed. CISA lists CVE-2026-76418 in its Known Exploited Vulnerabilities catalog, and Cisco states that its PSIRT became aware of active exploitation in October 2026. Organizations should treat vulnerable Internet-facing devices as attack targets rather than as systems exposed only to theoretical risk.
A verified public proof of concept was not identified in the consulted primary-source material. Cisco has not publicly disclosed exploit code or a detailed weaponized request sequence in the cited advisory material. The absence of a public PoC does not reduce the urgency of remediation because exploitation has already been confirmed independently of public exploit publication.
CISA records known ransomware campaign use as Unknown. That field does not contradict the confirmed exploitation status. It means the available CISA information does not establish whether the vulnerability has been used in a known ransomware campaign.
Sources
Cisco’s security advisory is the primary source for affected releases, fixed versions, product-specific guidance, and Cisco’s statement regarding active exploitation:
The National Vulnerability Database provides the CVE record, CVSS information, technical description, and publication metadata:
CISA’s Known Exploited Vulnerabilities catalog confirms exploitation in the wild, records the October 29, 2026 addition date, and sets the November 1, 2026 remediation deadline:
Use the Cisco advisory as the final authority for the exact supported upgrade target. CVE-2026-76418 is not a case for waiting on a public proof of concept: exploitation is already confirmed, the affected service is remotely reachable without authentication, and Cisco reports no effective workaround.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Detection should combine device health monitoring, VPN telemetry, and network observations. A reload by itself is not proof of exploitation: software faults, power events, administrative actions, and unrelated crashes can produce similar symptoms. The strongest investigation candidates are unexpected reloads that coincide with unusual SSL VPN connection attempts, especially on tunnel groups configured for secondary authentication.
Review ASA or FTD event logs around every unexplained reload. Preserve timestamps, source addresses, destination listener details, tunnel-group names where logged, authentication outcomes, crash information, and device uptime. Correlate those records with identity-provider logs, remote-access VPN telemetry, firewall management events, and upstream load-balancer or web-application firewall logs.
Technical Notes
Adapt useful log searches to the logging platform and Cisco event format. A generic SIEM query can identify reload-related events and SSL VPN activity near the same time:
(index=network OR index=firewall)
(device_vendor="Cisco" OR product="ASA" OR product="FTD")
(
message="*reload*"
OR message="*reboot*"
OR message="*unexpected*"
OR message="*crash*"
)
| transaction device_id maxspan=10m
| search message="*SSL*" OR message="*VPN*" OR message="*WebVPN*" OR message="*AnyConnect*"
This is a hunting pattern, not a vendor-specific signature. Validate field names and event IDs in the local SIEM. Also alert on a sequence in which a firewall reports an unexpected reload shortly after a burst of failed or malformed SSL VPN connection attempts from one or more external addresses.
At the network layer, review TLS and HTTP telemetry for connections to the Remote Access SSL VPN listener that are immediately followed by a device reset or loss of health checks. Avoid relying on a fixed payload signature because no verified public exploit pattern has been provided in the cited sources. Network controls can help reduce exposure, but they are not a substitute for upgrading the vulnerable software.
Remediation Steps
Cisco has released software updates that address CVE-2026-76418 and states that no workaround addresses the vulnerability. Prioritize Internet-facing ASA and FTD systems first, then remediate internal or segmented systems that provide SSL VPN access or could be reached through exposed paths.
Upgrade to the first fixed release appropriate for the deployed branch, or to a later Cisco-supported release selected through the vendor’s upgrade guidance. For ASA, the identified targets include 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and the applicable 9.24 fixed release. For FTD, the identified targets include 7.0.11, 7.2.13, and 7.4.9. Confirm the exact FTD 7.6 target in Cisco’s advisory before scheduling the change.
Technical Notes
The upgrade is normally performed through the Cisco-supported management workflow for the platform rather than by an arbitrary shell command. For ASA, administrators should use the documented image-upload and boot-variable procedure for the specific appliance and release. Before changing the boot image, verify the image checksum, export a configuration backup, confirm failover status, and test the upgrade path in a maintenance window.
For FTD, use the supported Firepower Management Center or local management upgrade workflow. A generic operational sequence is:
1. Identify the exact ASA or FTD release and hardware model.
2. Download the applicable Cisco fixed image from Cisco Software Central.
3. Verify the image integrity using Cisco-published checksums.
4. Back up the running configuration and management data.
5. Confirm failover, clustering, and VPN dependency status.
6. Upload and stage the fixed image in the supported management interface.
7. Schedule the upgrade and validate post-reboot health.
8. Confirm the running version is at or above the applicable fixed release.
9. Test Remote Access SSL VPN, secondary authentication, failover, and protected application reachability.
Do not treat disabling secondary authentication as a confirmed workaround. Cisco reports that there are no workarounds that address the vulnerability, and configuration changes could affect authentication security or business access without eliminating all risk. If an upgrade cannot be completed immediately, reduce Internet exposure where operationally possible, restrict access to trusted source networks, increase monitoring, and prepare to discontinue use of the affected product if required by applicable CISA guidance. These measures are temporary risk reduction, not a patch.
Because the CVE is in CISA KEV, federal agencies and other organizations subject to applicable CISA requirements should track the November 1, 2026 deadline and document exceptions, compensating controls, and recovery plans. Before rebooting a potentially exploited device, preserve relevant logs and crash artifacts when feasible and consistent with incident-response procedures.
Organizations reviewing broader identity and access exposure may also find our business password manager comparison useful when evaluating authentication dependencies around remote access.