CVE-2026-76418: Cisco Secure Firewall Zero-Day Exploited in SSL VPN Attacks

Cisco has released security updates for CVE-2026-76418, a high-severity zero-day vulnerability affecting the Remote Access SSL VPN service in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. The flaw is being actively exploited in the wild and can allow an unauthenticated remote attacker to force a vulnerable firewall to reload, causing a denial-of-service (DoS) condition and disrupting remote access.

Cisco assigned the vulnerability a CVSS 3.1 score of 8.6. The flaw requires no authentication or user interaction and has low attack complexity. Its primary security consequence is loss of availability rather than confidentiality or integrity compromise. Cisco has not associated the vulnerability with remote code execution or confirmed data theft.

The vulnerability is particularly important because edge security devices and VPN gateways are often directly exposed to the internet and provide critical access to corporate environments. Repeated exploitation could force affected appliances to restart and interrupt VPN connectivity for remote employees and administrators.

Cisco disclosed the vulnerability on October 28, 2026, after its Product Security Incident Response Team (PSIRT) became aware of active exploitation during October. The issue was originally identified by Eric Fernald while resolving a Cisco Technical Assistance Center support case.

For CVE-2026-76418 detection, security teams should prioritize monitoring internet-facing Cisco ASA and FTD appliances for unexpected reloads, repeated SSL VPN connection attempts, abnormal authentication activity, and availability disruptions affecting remote-access services.

SOC Prime’s AI-Native Detection Intelligence Platform enables security teams to strengthen visibility into vulnerability exploitation and suspicious behavior across SIEM, EDR, firewall, network, and identity telemetry.

Click Explore Detections to access relevant detection content and threat hunting logic. To Detect CVE-2026-76418, defenders should combine firewall configuration assessment with VPN telemetry, device-reload events, network activity, and authentication logs to identify exploitation attempts and confirm exposure.

Contact Sales

CVE-2026-76418 analysis

The vulnerability exists in the Remote Access SSL VPN functionality of Cisco Secure Firewall ASA and Secure FTD software.

According to Cisco, the root cause involves logic errors that occur when secondary authentication is configured on a tunnel group. An unauthenticated attacker can send a specially crafted request while connecting to the SSL remote-access VPN service and trigger an unexpected device reload.

Importantly, a successful VPN authentication is not required to reach the vulnerable processing path. This significantly increases the potential attack surface because an attacker only needs network access to the exposed SSL VPN service rather than valid VPN credentials.

The details for CVE-2026-76418 indicate that three primary conditions must be present for a device to be exposed:

• The firewall must run a vulnerable Cisco Secure Firewall ASA or FTD release.
• The SSL Remote Access VPN login service must be reachable.
• Secondary authentication must be configured within an affected tunnel group.

Cisco recommends administrators first determine whether SSL VPN functionality is enabled. On ASA systems, configurations containing webvpn with SSL VPN enabled on an interface require additional review. FTD administrators should inspect the deployed Remote Access VPN configuration through Secure Firewall Management Center or Device Manager.

Administrators should then inspect tunnel groups for:

secondary-authentication-server-group

When tunnel-group-list enable is configured, every tunnel group should be examined, including DefaultWEBVPNGroup. Cisco specifically warns that checking only connection profiles displayed on the VPN login page is insufficient.

Removing or disabling the tunnel-group list does not automatically eliminate exposure. If DefaultWEBVPNGroup still uses secondary authentication, the vulnerable path remains reachable.

CVE-2026-76418 affects Cisco Secure Firewall ASA and Secure FTD deployments that satisfy these configuration conditions and run vulnerable software releases.

Cisco has confirmed that the following products are not affected:

• Cloud-delivered Firewall
• Cloud-delivered Firewall Management Center
• Cisco Secure Access
• Secure Firewall Management Center Software

The flaw is categorized as CWE-690, which relates to an unchecked return value leading to a NULL pointer dereference. Cisco’s CVSS vector reflects network accessibility, low attack complexity, no privileges required, no user interaction, and high availability impact.

A successful attack does not provide the adversary with administrative access to the firewall based on the currently disclosed information. Instead, the appliance reloads unexpectedly, interrupting its availability.

Depending on network architecture, repeated exploitation could have broader operational consequences. An affected firewall may provide remote connectivity for employees, administrators, partners, or third-party services. Interrupting that gateway can therefore interfere with business operations even without compromising data.

Cisco has confirmed that attacks exploiting the vulnerability occurred during October 2026 but has not identified the threat actors responsible or disclosed victim information. CybersecurityNews likewise reports no confirmed connection to data theft or remote code execution.

The issue should also be distinguished from other recently disclosed Cisco firewall vulnerabilities. It is separate from previously reported flaws affecting Cisco ASA and VPN infrastructure, with different technical causes and exploitation paths.

At the time of writing, neither Cisco’s advisory nor the supplied reporting provides a public CVE-2026-76418 PoC containing reproducible exploit code. The absence of a public proof of concept does not reduce the urgency of remediation because Cisco has already confirmed real-world exploitation.

Cisco has also not published campaign-specific CVE-2026-76418 IOCs, such as attacker IP addresses, domains, payload hashes, or named threat infrastructure.

This means defenders should prioritize behavioral and configuration-based hunting rather than relying exclusively on static indicators.

Potential investigation points include:

• Unexpected ASA or FTD reloads without an administrative or maintenance explanation
• Repeated connections to the public SSL VPN service immediately before a reload
• Clusters of abnormal remote-access VPN requests from external infrastructure
• Repeated availability disruptions affecting the VPN gateway
• Firewall uptime unexpectedly resetting
• Unusual authentication activity surrounding device restarts
• Repeated connections from the same or related IP ranges before service interruption
• Multiple unexplained appliance reloads over a short period

Teams should also correlate firewall events with upstream network telemetry. Load balancers, edge routers, DDoS protection systems, IDS/IPS platforms, or external monitoring tools may retain evidence of connections that occurred immediately before the firewall became unavailable.

Preserving this telemetry is especially important when the firewall itself is repeatedly restarted because some volatile diagnostic information may be lost.

Organizations should additionally determine whether attackers attempted other activity before or after exploitation. Cisco currently characterizes the vulnerability as a denial-of-service flaw, so defenders should avoid automatically interpreting a device crash as evidence of full firewall compromise.

However, an unexplained restart of an internet-facing security appliance still warrants investigation, particularly when exploitation has been confirmed in the wild.

CVE-2026-76418 Mitigation

Cisco has released fixed ASA and FTD software and strongly recommends upgrading because no complete workaround addresses the underlying vulnerability.

The first fixed Cisco Secure Firewall ASA releases are:

ASA release branch	First fixed release
9.16 and earlier	9.16.4.104
9.18	9.18.4.96
9.20	9.20.4.50
9.22	9.22.3.200
9.23	9.23.1.48
9.24	9.24.1.27 / 9.24.10.1

For Secure FTD, Cisco lists:

FTD release branch	First fixed release
7.0 and earlier	7.0.11
7.2	7.2.13
7.4	7.4.9
7.6	7.6.7
7.7	7.7.14
10.0	10.0.3
10.1	10.1.1

Organizations should use Cisco’s Software Checker and compatibility documentation to determine the correct fixed release for their specific hardware and currently installed software branch.

Although Cisco lists no workaround that fully addresses the vulnerability, it documents temporary configuration mitigations involving secondary authentication.

The recommended CVE-2026-76418 mitigation depends on how tunnel groups are configured.

If DefaultWEBVPNGroup does not use secondary authentication, administrators can disable the tunnel-group list using:

no tunnel-group-list enable

This prevents users from selecting a connection profile from a list and instead requires them to know the correct profile.

If DefaultWEBVPNGroup does use secondary authentication, administrators can remove it using:

no secondary-authentication-server-group

However, Cisco warns that removing secondary authentication reduces the security posture of remote-access VPN authentication. Organizations should therefore carefully evaluate this temporary measure before deploying it.

These changes should be considered temporary risk-reduction measures rather than replacements for patching.

Because exploitation is already occurring, organizations should prioritize systems that are:

• Internet-facing
• Running vulnerable ASA or FTD releases
• Providing SSL remote-access VPN connectivity
• Using secondary authentication
• Supporting critical remote workforce or administrative connectivity

Security teams should also verify whether high availability or failover architecture could reduce operational disruption while upgrades are performed.

After applying updates, confirm the running software version and verify that the appliance has successfully returned to service.

Administrators should review system logs covering the period before patching for unexplained reloads or other indications of exploitation.

If suspicious activity is identified, preserve relevant:

• ASA or FTD system logs
• Remote-access VPN logs
• Authentication telemetry
• Firewall configuration history
• Upstream network flow data
• External monitoring data
• Identity provider logs associated with secondary authentication

Because Cisco has disclosed only an availability impact, responders should distinguish confirmed evidence from speculation. An unexpected firewall restart does not by itself establish that an attacker obtained configuration files, credentials, or code execution.

Nevertheless, organizations experiencing unexplained device reloads should review adjacent systems and authentication activity to ensure attackers were not simultaneously attempting other techniques.

Administrators should also avoid delaying upgrades solely because no public exploit code is available. Active exploitation occurred before public disclosure, demonstrating that at least one attacker already possessed the capability to trigger the vulnerable behavior.

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If relevant detections are not yet available, check again as new threat intelligence and detection content are continuously added.