Cisco ASA/FTD CVE-2026-76418: Actively Exploited SSL VPN DoS with Secondary Authentication

1. Basic Information

• Advisory: Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
• Publisher: Cisco
• Published: 2026-10-28T19:15:00Z
• Source: Cisco
• Related Sources: BleepingComputer
• Related Sources: SecurityWeek
• Related Sources: CISA KEV catalog data
• Associated Malware: None specified
• Associated Threat Groups: None specified
• Associated CVEs: CVE-2026-76418
• Affected Products: Cisco ASA, Cisco FTD, SSL VPN/WebVPN
• Severity: high

2. Executive Summary

Cisco has confirmed active exploitation of CVE-2026-76418, a vulnerability where crafted requests to SSL VPN tunnel groups using secondary authentication cause ASA and FTD devices to reload, and has released fixed software.

The issue warrants high priority because unauthenticated attackers can disrupt firewall and VPN availability, exploitation has been confirmed, and no complete workaround is available.

3. Attack Flow

Attack Flow

1. An unauthenticated attacker sends a crafted request to an SSL VPN login endpoint meeting the affected conditions.
2. A logic error in secondary authentication processing leads to a null pointer dereference, causing the device to reload and resulting in a denial of service. A successful VPN login is not required.

4. Attacker Position and Execution Location

• An unauthenticated attacker with network access to the SSL VPN interface.

5. Victim and Administrator Perspective

Victim

• Observed as a sudden disconnection from the VPN.

Administrator

• Observed through reloads, crash info logs, and availability alerts.

6. Conditions for Success and Failure

Conditions for Success

• Exploitation requires a vulnerable ASA or FTD release, a reachable SSL VPN login service, SSL VPN enabled on at least one webvpn interface, and secondary authentication in an applicable tunnel group. If tunnel-group-list enable is configured, administrators must check all tunnel groups, including DefaultWEBVPNGroup; the device is affected if any applicable group uses secondary authentication. If the group list is disabled, the device remains affected when DefaultWEBVPNGroup uses secondary authentication.

Conditions for Failure and Mitigations

• Update to the fixed release for the applicable version series. For example, the first fixed releases are ASA 9.20.4.50 for the ASA 9.20 series and FTD 7.4.9 for the FTD 7.4 series. Verify other series using Cisco advisories and the Software Checker.
• There is no complete workaround; updating is required. If secondary authentication is not used on DefaultWEBVPNGroup, disabling tunnel-group-list enable serves as a temporary mitigation. Removing secondary authentication when it is used on DefaultWEBVPNGroup lowers authentication strength, so an impact assessment is required.

7. Impact of Successful Exploitation

• Degradation of firewall and VPN availability.

8. Observable Logs

Inference: The following are candidate logs to investigate within your organization. Availability depends on log collection, retention settings, and product visibility, and does not imply that all items were recorded in primary sources.

• Email: None available
• Proxy / SWG / DNS: None available
• Endpoint / EDR: Collect device-side crash information, reload reasons, and webvpn configurations. General EDR platforms may not capture these items.
• Identity / IdP: None available
• SaaS / Cloud: None available
• Network: Review SSL VPN requests immediately preceding the reload.

9. Attack Success Determination

Inference: The following is an internal determination criterion and does not imply that primary sources observed all stages of success.

• Attack Attempt Observed (Success Unconfirmed): Criteria: Even if the arrival of a crafted request is confirmed, the occurrence of a reload or denial of service must be verified separately. Denial of service affects availability and does not constitute follow-on compromise. Target: VPN

10. Investigation Playbook

Inference: Internal investigation procedure.

• Trigger: Unexpected reload, crash info logs
• Initial Checks: Verify target product version, exposure scope, time synchronization, and log retention.
• Endpoint: Preserve target device configurations, processes, files, and reboot history.
• Identity and Cloud: Verify administrator authentication and API operations.
• Follow-on Activity: Track subsequent internal connections, credential usage, configuration changes, and outbound traffic.
• Containment: Assess availability and business impact, then restrict access, apply fixed versions, and perform recovery. Do not treat denial of service alone as evidence of credential theft; if separate evidence of compromise exists, investigate and respond to that evidence.
• Assessment Categories: Distinguish request receipt from a confirmed denial-of-service outcome, and cross-reference configurations, request timestamps, crash information, and reload reasons. Do not conclude exploitation from a reload alone; consult Cisco TAC if necessary.

11. Defense and Detection Ideas

• Single Events: Detect crash signatures immediately following SSL VPN requests.
• Timeline Correlation: Correlate request bursts with availability loss.
• Hunting: Inventory tunnel groups utilizing secondary authentication.
• Logging Gaps: Encrypted request contents may not be visible.
• Priority Controls: Prioritize patching, high availability setups, and VPN exposure inventories.

12. Facts, Inferences, and Hypotheses

Facts

• Cisco describes the issue as a logic error in secondary authentication handling, classified as CWE-690 with a CVSS v3.1 score of 8.6. CISA KEV data notes it as a null pointer dereference resulting from an unchecked return value.
• Unauthenticated attackers can trigger device reloads without requiring successful VPN logins.
• Exploitation requires a vulnerable ASA or FTD release, a reachable SSL VPN login service, SSL VPN enabled on at least one webvpn interface, and secondary authentication in an applicable tunnel group. If tunnel-group-list enable is configured, administrators must check all tunnel groups, including DefaultWEBVPNGroup; the device is affected if any applicable group uses secondary authentication. If the group list is disabled, the device remains affected when DefaultWEBVPNGroup uses secondary authentication.
• Cisco acknowledged active exploitation in October 2026, but threat actors, targets, incident counts, and IOCs have not been publicly disclosed.
• There is no complete workaround; updating is required. If secondary authentication is not used on DefaultWEBVPNGroup, disabling tunnel-group-list enable serves as a temporary mitigation. Removing secondary authentication when it is used on DefaultWEBVPNGroup lowers authentication strength, so an impact assessment is required.
• CISA added CVE-2026-76418 to the KEV catalog on October 29, 2026, confirming active exploitation of this denial-of-service vulnerability, which does not indicate remote code execution or credential theft.

Inference

• Inference: Do not assume reloads are attacks without verifying preceding requests and crash information.

Hypothesis

No additional hypotheses. Unconfirmed items are noted in Unknowns and Limitations.

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1499.004	Application or System Exploitation	high	Device reload and service disruption caused by crafted requests. Code execution has not been confirmed.

14. Unknowns and Limitations

• Threat actors, targets, incident counts, and request IOCs are unknown.

15. Impact on SOCs and Organizations

Inventory SSL VPN implementations using secondary authentication and update them to fixed releases.

16. Summary by Role

• SOC: Correlate requests immediately preceding reloads with crash information.
• Administrators: Verify webvpn configurations and apply updates.
• Users: Follow alternative access procedures during VPN outages.