Cisco ASA/FTD SSL VPN Secondary Auth Logic Error Enables Remote DoS
Logic errors in Cisco ASA/FTD SSL VPN secondary authentication let unauthenticated remote attackers reload the firewall, causing a denial-of-service condition.
- Vendor
- Cisco
- Product
- Secure Firewall ASA and Threat Defense (FTD) Software
- CVSS
- 8.6
- EPSS (exploit probability)
- 0.6%
- Status
- exploited-in-wild
- Published
Is CVE-2026-76418 being exploited?
Exploitation has been reported (sources in the write-up below), but CVE-2026-76418 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-29 snapshot.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.6% (scored October 29, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-29. Full cross-catalog view: /kev-comparison
CVE-2026-76418 timeline
- Published to NVD
- Exploitation reported+1dCisco PSIRT confirmed active exploitation in October 2026; no attribution or IoCs shared
- First 0dayNews coverage+1d
- Patch available+1dCisco released fixes for ASA and FTD across all affected release trains
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-76418 is a high-severity denial-of-service vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software. The flaw stems from logic errors in secondary authentication handling within tunnel groups.
Conditions for exploitation: The device must be running a vulnerable release, have the SSL VPN login service reachable from the network, and have secondary authentication configured on at least one tunnel group (including the default DefaultWEBVPNGroup). A successful VPN session is not required to reach the affected code path.
Impact: An unauthenticated, remote attacker can send a crafted request during SSL VPN connection setup to cause the firewall to reload unexpectedly, resulting in a sustained DoS condition.
Patch: Cisco released fixes on October 29, 2026:
- ASA 9.16 and earlier: fixed in 9.16.4.104
- ASA 9.18: fixed in 9.18.4.96
- ASA 9.20: fixed in 9.20.4.50
- ASA 9.22: fixed in 9.22.3.200
- ASA 9.23: fixed in 9.23.1.48
- ASA 9.24: fixed in 9.24.1.27 or 9.24.10.1
- FTD 7.0 and earlier: fixed in 7.0.11
- FTD 7.2: fixed in 7.2.13
- FTD 7.4: fixed in 7.4.9
- FTD 7.6: fixed in 7.6.7
- FTD 7.7: fixed in 7.7.14
- FTD 10.0: fixed in 10.0.3
- FTD 10.1: fixed in 10.1.1
Temporary mitigation (not a substitute for patching): Disable the tunnel group list if DefaultWEBVPNGroup does not use secondary authentication, or remove secondary authentication from any user-configured tunnel group. Cisco warns that removing secondary authentication weakens VPN security and recommends upgrading to a fixed release instead.
Cisco’s cloud-delivered firewall, Secure Access, and Secure Firewall Management Center are not affected.
This is the second actively exploited DoS zero-day targeting Cisco ASA/FTD SSL VPN since August 2026. The earlier flaw, CVE-2026-20349, exploited HTTP request processing in the same service.
Other Cisco CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability | [ CRITICAL ] | 9.8 | 2.2% | |
| CVE-2026-76501 Cisco NX-OS SRv6 NGOAM unauthenticated root RCEwrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-76471 Cisco NX-OS NX-API unauthenticated root RCEwrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-76504 Cisco Catalyst SD-WAN Manager Authentication Bypasswrite-up | [ CRITICAL ] | 9.8 | 38.9% | |
| CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerabilitywrite-up | [ CRITICAL ] | 10.0 | 75.6% | |
| CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerabilitywrite-up | [ CRITICAL ] | 9.8 | 29.5% | |
| CVE-2026-20079 Cisco FMC Authentication Bypass Enables Root OS Accesswrite-up | [ CRITICAL ] | 10.0 | 88.5% | |
| CVE-2026-20212 Unauthenticated RCE in Cisco Nexus 9000 Silicon One Switcheswrite-up | [ CRITICAL ] | 9.8 | 0.8% | — |
