Cisco ASA/FTD CVE-2026-76418: second SSL VPN DoS zero-day

Home » Alert » Cisco ASA/FTD CVE-2026-76418: second SSL VPN DoS zero-day

ALERT · Actively exploited. Last updated 29 October 2026. See the Alert Tracker

If you run Cisco Secure Firewall ASA or Threat Defense with Remote Access SSL VPN and secondary authentication on any tunnel group, treat CVE-2026-76418 (opens in a new tab) as urgent. Cisco says the flaw is being exploited; CISA has not yet listed it on KEV.

What it is

Three conditions that make an ASA or FTD vulnerable to CVE-2026-76418: webvpn enabled, SSL VPN login reachable, and secondary-authentication-server-group set
Cisco’s three exposure conditions for CVE-2026-76418. Source: Cisco advisory.

CVE-2026-76418 (opens in a new tab) (Cisco bug CSCwx26625, CWE-690) is an unauthenticated denial-of-service in the Remote Access SSL VPN secondary-authentication path. A crafted HTTPS request can reload the device. Cisco rates it CVSS 3.1 8.6 High (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H). It is the second ASA/FTD VPN DoS zero-day since August, after CVE-2026-20349 (opens in a new tab) (already on CISA KEV).

Who is affected

ASA CLI show commands to check webvpn enable, secondary-authentication-server-group, and software version
Quick CLI checks that mirror Cisco’s Vulnerable Products guidance. Authorised estates only.

An ASA or FTD device is vulnerable when all three conditions are true:

  1. webvpn is enabled on at least one interface.
  2. The Remote Access SSL VPN login service is reachable from the attacker’s path.
  3. secondary-authentication-server-group is configured on any tunnel group, including DefaultWEBVPNGroup — whether or not tunnel-group-list is enabled.

Not vulnerable per Cisco: Cloud-delivered Firewall (CDFW), Cloud-delivered Firewall Management Center (cdFMC), Cisco Secure Access, and Secure Firewall Management Center itself. On FTD managed by FMC, review Remote Access VPN under Devices > VPN.

show running-config webvpn | include enable
show running-config tunnel-group | include secondary-authentication-server-group
show running-config tunnel-group DefaultWEBVPNGroup
show version | include Software Version

Exploitation status

Timeline comparing CVE-2026-76418 (Cisco aware of exploitation; not yet on CISA KEV) with CVE-2026-20349 (on KEV since 11 August 2026)
Cisco is aware of active exploitation of CVE-2026-76418; CISA KEV catalogue 2026.10.28 still lists only the earlier VPN DoS CVE-2026-20349.

Cisco’s Product Security Incident Response Team states it is aware of active exploitation in October 2026. As of CISA KEV catalogue 2026.10.28 (checked 29 October 2026 Europe/London), CVE-2026-76418 is not listed. The earlier VPN DoS CVE-2026-20349 has been on KEV since 11 August 2026. FIRST has not yet published an EPSS score for CVE-2026-76418.

Fixed versions

Table of first fixed ASA and FTD software releases for CVE-2026-76418
First fixed releases by train. Source: Cisco PSIRT advisory, first published 28 October 2026.

ASA Software — first fixed: 9.16.4.104 (covers 9.16 and earlier), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1.

FTD Software — first fixed: 7.0.11 (covers 7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1.

Cisco lists no workarounds. Temporary mitigations that remove secondary authentication or disable tunnel-group-list reduce exposure but also weaken MFA posture — treat them as short-lived only.

How to hunt

Four hunt panels for unexpected ASA reloads using verified 199001, 199002, 199005 and 199010 syslog IDs plus Sigma, KQL and Splunk
Hunt unexpected reloads and crashinfo while devices remain unpatched.

While you are still on a vulnerable train, hunt unexplained reloads and crash dumps that line up with SSL VPN reachability. Useful starting points (retarget to your field names):

# Verified ASA reload / boot / signal tokens (Cisco ASA Syslog Messages guide)
# https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/asa-syslog/syslog-messages-101001-to-199021.html
%ASA-5-199001   # Reloaded at <time> by <user>. Reload reason: <reason>
%ASA-6-199005   # Startup begin
%ASA-6-199002   # Startup completed. Beginning operation.
%ASA-1-199010   # Signal <n> caught in process/fiber (serious-error recovery)
reload
crashinfo
traceback

# Splunk (CIM / cisco:asa)
index=* sourcetype=cisco:asa (reload OR crash OR crashinfo OR traceback OR "%ASA-5-199001" OR "%ASA-6-199002" OR "%ASA-6-199005" OR "%ASA-1-199010" OR "Reload reason" OR "Startup begin" OR "Startup completed")
| stats count min(_time) as first max(_time) as last by host, sourcetype

# Microsoft Sentinel / Defender XDR (KQL)
CommonSecurityLog
| where DeviceVendor == "Cisco" and DeviceProduct has_any ("ASA","FTD","Secure Firewall")
| where Message has_any ("reload","crash","crashinfo","traceback","199001","199002","199005","199010","Reload reason","Startup begin","Startup completed")
| summarize count(), min(TimeGenerated), max(TimeGenerated) by DeviceName, DeviceProduct

On the box itself, run show crashinfo / show crashinfo files and show version (uptime and last reload reason) and compare with change tickets — see Cisco’s crashinfo CLI and traceback RCA guidance. A Sigma starting point ships with this pack under hunt/. Planned upgrades also emit 199001/199005/199002, so correlate before you escalate. Failover-cable messages (%ASA-1-101001 / %ASA-1-101002) are not reload indicators.

What to do

Four-step remediation checklist: upgrade, confirm exposure, temporary mitigation only, hunt reloads
Upgrade is the fix. Mitigations that drop secondary auth are temporary only.
  1. Upgrade each ASA/FTD train to the first fixed release (or later) from the advisory.
  2. Re-run the three-condition check after the change window.
  3. Use Cisco’s temporary mitigations only if you cannot patch immediately, and restore MFA as soon as you can.
  4. Review unexpected reloads and crashinfo from the unpatched window; escalate anything without a matching change record.

Sources

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)