Exploited Cisco VPN Flaw Can Reload ASA and FTD Firewalls
Cisco has reported active exploitation of a flaw that can make Secure Firewall ASA and FTD devices reload unexpectedly. A crafted request to the SSL remote-access VPN service can interrupt connectivity before an attacker has successfully logged in. Exposure depends on the software release and the secondary-authentication settings of the relevant tunnel groups.
The vulnerability, CVE-2026-76418, is rated High with a CVSS score of 8.6. Cisco describes a network attack requiring neither an authenticated account nor user interaction. The documented impact is denial of service through a device reload, putting firewall availability at risk.
For operators, the immediate job is to identify reachable SSL VPN services, check the full authentication configuration and select an appropriate fixed software image. Preserve authentication protections while planning that change.
Known exploitation changes the priority
Cisco’s advisory was first published on 28 October at 19:15 GMT. The official CVE record followed at 20:05:31 UTC that day. Cisco says its Product Security Incident Response Team became aware of active exploitation during October. The advisory gives no precise first-attack date, actor attribution or victim count.
CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 29 October. The entry records a 1 November remediation due date and refers to BOD 26-04. That date is catalogue metadata, not a universal legal deadline for every organisation. The exploitation evidence gives operators a reason to prioritise remediation according to their own exposure and applicable obligations.
Check the default group as well as visible profiles
Cisco identifies three conditions that must be considered together:
- The device runs an affected ASA or FTD software release.
- The SSL remote-access VPN login service is reachable.
- Secondary authentication is configured in the relevant tunnel-group scope described by the advisory.
When the tunnel-group list is enabled, examine every tunnel group, including DefaultWEBVPNGroup, for secondary-authentication-server-group. The profiles displayed on the login page do not provide a complete exposure check.
If the group list is absent or disabled, the default group still matters. A configured secondary-authentication server group on DefaultWEBVPNGroup can retain the vulnerable processing path even when the connection-profile menu is hidden. A successful VPN login is not required to reach that path.
For FTD, Cisco directs administrators to review the deployed remote-access VPN policy and the resulting device configuration through Secure Firewall Management Center or Firewall Device Manager. The policy and the running configuration both need attention.
Cisco lists Cloud-delivered Firewall, Cloud-delivered Firewall Management Center, Secure Access and Secure FMC Software as products not affected by this vulnerability. Assess the ASA or FTD device itself, even when its management platform is excluded.
Use the complete vendor fixed-release table
Cisco has released fixes. Its Fixed Software section gives the following first fixed releases for this advisory.
| ASA release | First fixed release |
|---|---|
| 9.16 and earlier | 9.16.4.104 |
| 9.18 | 9.18.4.96 |
| 9.20 | 9.20.4.50 |
| 9.22 | 9.22.3.200 |
| 9.23 | 9.23.1.48 |
| 9.24 | 9.24.1.27 9.24.10.1 |
| FTD release | First fixed release |
|---|---|
| 7.0 and earlier | 7.0.11 |
| 7.2 | 7.2.13 |
| 7.4 | 7.4.9 |
| 7.6 | 7.6.7 |
| 7.7 | 7.7.14 |
| 10.0 | 10.0.3 |
| 10.1 | 10.1.1 |
The ASA 9.24 row contains both 9.24.1.27 and 9.24.10.1 in one fixed-release cell. Cisco supplies no footnote assigning the two builds to individual platforms. Preserve both values when checking the advisory and confirm the target for the actual device.
A larger-looking version number is insufficient proof that an image is fixed. The CVE record contains explicit affected builds but no matching fixed-version objects, and some affected suffixes are numerically higher than a listed first fix. Use Cisco Software Checker for the exact software, platform and release, or confirm the appropriate target with Cisco TAC.
Also check the applicable ASA compatibility matrix, ASA upgrade path or FTD compatibility guidance, including ASDM or FXOS requirements where relevant. A first-fix row does not establish that every appliance can take that image directly.
The linked BlackTree vulnerability record provides identity and exploitation context. Its structured mapping of affected products to fixed versions remains incomplete; Cisco’s published matrix is the remediation reference for this report.
Preserve authentication while completing the upgrade
Cisco says no workaround remediates the flaw. Its advisory describes configuration mitigations and warns that removing secondary authentication lowers the VPN’s security posture. Plan remediation around an appropriate fixed image while preserving authentication controls, including any two-factor protection already deployed.
Before the change, record the current software and platform, review the supported upgrade route, and validate backups and recovery arrangements. Afterward, confirm the running image and test normal VPN authentication and required traffic flows. Review unexpected reloads with the relevant logs and Cisco support; a reload alone does not establish that this vulnerability was exploited on a particular device.
