Denial of Service Vulnerability in Cisco Secure Firewall ASA Under Active Exploitation (CVE-2026-76418)

Executive Summary

On October 28th, 2026, Cisco disclosed a high-severity vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software and confirmed it is under active exploitation. Tracked as CVE-2026-76418, the flaw lets an unauthenticated, remote attacker force the firewall to reload by sending a crafted request to the SSL remote access VPN service. Devices are affected only when SSL VPN is enabled and secondary authentication is configured on a tunnel group.

ASA and FTD firewalls sit at the network perimeter and provide remote access VPN for many organizations. Each forced reload drops active VPN sessions and interrupts traffic that depends on the firewall.

Given confirmed exploitation, unauthenticated reach to an internet-facing VPN service, and earlier exploitation of the same service this year, Beazley Security recommends affected organizations apply available fixes immediately and conduct a thorough review for any signs of compromise.

Affected Systems or Products

Mitigations / Workarounds

Cisco states that disabling secondary authentication on any user-configured tunnel group list or on the default tunnel group, DefaultWEBVPNGroup may help to temporarily mitigate the issue. Cisco notes that disabling secondary authentication may also degrade the security posture of remote access VPN, and should be weighed against organizational authentication requirements.

If patching cannot be immediately applied, the following may help to temporarily reduce risk:

• 

  If DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel group list by entering

no tunnel-group-list enable

• 

  in WebVPN configuration mode. Users will no longer choose a connection profile from a list and must know the correct profile to use.

• 

  If DefaultWEBVPNGroup uses secondary authentication, remove it with the

no secondary-authentication-server-group

command. Disabling the group list alone does not reportedly remove exposure in this case.

• 

  On FTD, Cisco directs administrators to review the deployed remote access VPN policy and the resulting device running configuration in Secure Firewall Management Center (FMC) or Secure Firewall Device Manager (FDM).

• 

  Where operationally feasible, limit which networks can reach the SSL VPN login service. Cisco lists a reachable login service as a precondition for exploitation.

Patches

Cisco has released software updates for ASA and FTD that address this vulnerability. Fixed releases are listed in the Fixed Software section of the Cisco advisory. Cisco confirms that Cloud-delivered Firewall, Cloud-delivered Firewall Management Center, Secure Access, and Secure FMC Software are not affected.

Indicators of Compromise

Cisco states that its Product Security Incident Response Team (PSIRT) became aware of active exploitation of CVE-2026-76418 in October 2026. Cisco has not attributed the activity, described the requests used, or published indicators of compromise at the time of this writing.

Successful exploitation causes the device to reload unexpectedly. On ASA and FTD devices that run SSL VPN with secondary authentication, defenders can review the period since October 2026 for unexpected reloads, crash information, and gaps in syslog. A successful VPN login is not required to trigger this flaw, so exploitation attempts may not appear as failed or successful authentication events.

Technical Details

CVE-2026-76418 stems from logic errors in the Remote Access SSL VPN service when secondary authentication is configured on a tunnel group. An attacker sends a crafted request while connecting to the SSL remote access VPN, and the device reloads. No credentials or user interaction are required, and Cisco states that a successful VPN login is not needed to reach the affected processing path.

Cisco considers ASA or FTD devices vulnerable when running an affected release, exposing the SSL remote access VPN login service, and using secondary authentication within the relevant tunnel group. SSL VPN is enabled when the running configuration contains webvpn and the service is active on at least one interface:

• 

  If tunnel-group-list enable is configured, check tunnel groups, including DefaultWEBVPNGroup, for

secondary-authentication-server-group

• 

  If tunnel-group-list enable is absent or was removed, check DefaultWEBVPNGroup for

secondary-authentication-server-group

Note that disabling the group list does not remove exposure when the default group uses secondary authentication.

On FTD, review the deployed remote access VPN policy and the resulting running configuration on the device in FMC or FDM. Cisco has not published further technical detail, and no public proof-of-concept (PoC) is known at the time of writing.

The same ASA and FTD remote access VPN service was targeted earlier this year. On August 11th, 2026, Cisco disclosed CVE-2026-20349, an unauthenticated denial of service flaw caused by insufficient error checking when the Remote Access SSL VPN service processes HTTP requests. Cisco confirmed exploitation in August 2026, and CISA added CVE-2026-20349 to its Known Exploited Vulnerabilities (KEV) catalog.

How Beazley Security is responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• 

  NVD: CVE-2026-76418

• 

  Cisco: Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability