Cisco patches an SSL VPN zero-day already crashing ASA and FTD boxes
CVE-2026-76418 lets an unauthenticated attacker reload Cisco Secure Firewall ASA and FTD devices mid-handshake, and CISA added it to its exploited list a day after the advisory.
Cisco published an advisory on 28 October for CVE-2026-76418, a flaw in the Remote Access SSL VPN service of Secure Firewall ASA and FTD software. A logic error in how secondary authentication is handled on a tunnel group lets an unauthenticated remote attacker send a crafted request during a VPN connection attempt and force the device to reload. CISA added the bug to its Known Exploited Vulnerabilities catalogue the next day, 29 October, confirming Cisco’s PSIRT had already seen it exploited in October.
The flaw only applies to devices with SSL remote access VPN enabled and secondary authentication configured on a tunnel group, CVSS 8.6. There’s no workaround: Cisco says disabling secondary authentication or the tunnel group list mitigates it, but at the cost of the security or functionality that configuration provides. Fixed releases are out for both lines, ASA 9.16.4.104 through 9.24.10.1 and FTD 7.0.11 through 10.1.1 depending on your branch.
Why it matters: this is the kind of edge appliance that sits directly on the internet, and an unauthenticated crash-on-demand bug against it is a denial-of-service lever for anyone who can reach the VPN endpoint. If you run ASA or FTD with secondary authentication on a tunnel group, check your version against Cisco’s fixed list now rather than waiting for a scheduled patch window.
The caveat: Cisco describes the impact as a reload, not code execution, so this is disruption rather than a full compromise, for now.