Small Town Sysadmin
Free CJIS checklist

Networks

Security alert

Cisco ASA and FTD firewalls: an exploited VPN flaw can force reboots, and the fix is a software update

CVE-2026-76418 lets an unauthenticated attacker crash Cisco ASA and FTD firewalls that use secondary authentication on the SSL VPN. It is exploited now. Here is how to check and what to install.

If your office or agency runs a Cisco Secure Firewall ASA or Secure Firewall Threat Defense (FTD) device with the SSL remote access VPN turned on, check it today. Cisco published an advisory on October 28, 2026 for CVE-2026-76418, and the Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog on October 29. Cisco says its Product Security Incident Response Team became aware of active exploitation in October 2026.

This flaw is a denial of service, not a takeover. An attacker with no login can send a crafted request to the VPN login service and make the firewall reload. For a small shop with one firewall, that means the VPN and likely the whole internet connection drop each time, and the attacker can repeat it. Cisco rates it High, with a base CVSS score of 8.6. CISA’s federal due date is November 1, 2026.

Who is affected

Cisco says a device is vulnerable only if all three of these are true:

  • It runs a vulnerable release of ASA Software or FTD Software.
  • The SSL remote access VPN login service is reachable. In the ASA configuration this means the webvpn keyword is present and enabled on at least one interface.
  • Secondary authentication is configured on a tunnel group. This is the second login prompt some offices add, for example a directory password plus a separate one-time code or second server.

A tunnel group is Cisco’s name for a VPN connection profile. Cisco notes that a successful VPN login is not required to reach the affected code, and that the check covers every tunnel group, including ones that do not appear in the login page’s drop-down list.

Cisco lists Cloud-delivered Firewall, cdFMC, Secure Access, and Secure FMC Software as not affected.

Check your exposure

  1. Find the firewalls. Include ones your MSP or a vendor installed for you.
  2. Check the version. On an ASA, show version shows the software release. For FTD, use the device page in Secure Firewall Management Center or Device Manager. Cisco also provides a Software Checker on its site that matches a release to this advisory.
  3. Check for SSL VPN. Look for webvpn with an enable line for an interface in the running configuration. On FTD, look under remote access VPN in FMC or Device Manager.
  4. Check for secondary authentication. Look in each tunnel group, and always in the default one, DefaultWEBVPNGroup, for a secondary-authentication-server-group line. Cisco says the default group counts even if the group list is turned off.

If you do not use the SSL VPN, or no tunnel group has secondary authentication, this particular flaw does not apply.

Fix it

Cisco’s fixed software, by release train, as listed in the advisory:

ASA release First fixed release
9.16 and earlier 9.16.4.104
9.18 9.18.4.96
9.20 9.20.4.50
9.22 9.22.3.200
9.23 9.23.1.48
9.24 9.24.1.27 and 9.24.10.1 are both listed
FTD release First fixed release
7.0 and earlier 7.0.11
7.2 7.2.13
7.4 7.4.9
7.6 7.6.7
7.7 7.7.14
10.0 10.0.3
10.1 10.1.1

Confirm your exact target in Cisco’s advisory or Software Checker before you schedule the change, and check the hardware compatibility and upgrade guides Cisco links, because not every older model supports the newest trains. FTD devices are upgraded through their management platform.

If you cannot patch today

Cisco says there is no workaround, but it describes one mitigation: remove secondary authentication from the affected tunnel groups.

  • If the default group does not use secondary authentication, turn off the tunnel group list with no tunnel-group-list enable. Users will then need to know their exact profile name to connect.
  • If the default group does use secondary authentication, remove it with no secondary-authentication-server-group.

Removing secondary authentication lowers the security of your remote access VPN. For a CJIS or bank-connected network, that can break an MFA requirement. Treat it as a short stopgap, get your CJIS Systems Agency, examiner, or counsel’s view if it affects a compliance control, and put the setting back after you update.

Afterward

  • Look for unexplained reboots. Check the firewall’s uptime and logs for reloads you did not schedule. Repeated reloads from a remote address are the sign to look for.
  • Record the date you patched. Examiners tend to treat KEV items as the benchmark.
  • Limit VPN exposure. If only a few people need remote access, restrict which source addresses can reach the login page where your setup allows it.

This is separate from the earlier Cisco FMC authentication bypass, which affects the management server rather than the firewall’s VPN service.

Sources

All articles