Cisco Fixes Actively Exploited SSL VPN Flaw in ASA and FTD Firewalls
Cisco released fixes for CVE-2026-76418, an actively exploited flaw in the SSL VPN service of ASA and FTD firewalls. An unauthenticated attack can trigger a device restart and service outage.
Cisco SSL VPN fixes address the CVE-2026-76418 vulnerability in Cisco Secure Firewall ASA and FTD firewalls. Cisco published the advisory on October 28 and stated that it was aware of active exploitation of the flaw in October 2026. The vulnerability has a CVSS score of 8.6.
The flaw affects the Remote Access SSL VPN service. According to Cisco, an unauthenticated remote attacker can send a crafted request while connecting to the VPN and trigger a device restart. The publicly confirmed consequence is denial of service, meaning the affected firewall or remote VPN access becomes unavailable.
Cisco SSL VPN fixes for ASA and FTD
Not all ASA and FTD deployments are affected indiscriminately. According to Cisco, specific conditions must be met: SSL VPN must be accessible, and secondary authentication must be configured in the affected tunnel group. Organizations should therefore review their remote-access configuration, including DefaultWEBVPNGroup and secondary authentication settings.
Cisco has released fixed software versions. Complete remediation requires updating to the release specified by the manufacturer in the security advisory. Administrators should base their planning on the exact software version in use and their device’s compatibility.
Temporary mitigation without updating
If an update cannot be deployed immediately, Cisco also lists temporary mitigations. Depending on the configuration, administrators can disable secondary authentication or the tunnel-group list. However, this is not a full substitute for a software fix.
For operators, it is important that the attack does not require authentication if the device meets the stated configuration conditions. Repeatedly triggering restarts can cause remote-access outages for users and disrupt the availability of services passing through the firewall.
What Cisco has not confirmed so far
Cisco has not disclosed the attackers’ identity, the campaign’s scope, its targets, or indicators of compromise. Publicly available information also does not confirm remote takeover of the device or data theft through CVE-2026-76418. The described and confirmed impact of the vulnerability is a forced restart and denial of service.
Further developments will show whether the U.S. agency CISA adds CVE-2026-76418 to its Known Exploited Vulnerabilities catalog. Any publication of technical details, indicators of compromise, or information about the scope of the attacks by Cisco or security researchers will also be important.
Sources
- Cisco Security Advisory – Confirms the CVE, active exploitation in October 2026, vulnerability conditions, DoS impact, mitigation, and fixed releases.
- SecurityWeek – Independently summarizes the impact on ASA/FTD, unauthenticated exploitation, and the absence of attacker details.
- BleepingComputer – Corroborates that Cisco released fixes for an actively exploited DoS flaw in ASA and FTD.
Verified and updated: 10/29/2026 15:22
