74 openlast updated

HomeOctober 2026 patch cycleCVE-2026-76418 Cisco ASA/FTD: exploited SSL VPN crash bug

Patch nowEnterprisefrom 2026-10

CVE-2026-76418 Cisco ASA/FTD: exploited SSL VPN crash bug

Part of October 2026 patch cycle

Vendor
Cisco
Products
Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense (FTD)
Published
· updated
Status
Open

Update, Oct 30: CISA added CVE-2026-76418 to its Known Exploited Vulnerabilities catalog on Oct 29 and gave federal agencies until Nov 1 to fix it. That’s a short deadline, and it lands on a weekend. (CISA)

Call: Patch now. Cisco says CVE-2026-76418 is being exploited. One crafted request to the Remote Access SSL VPN login makes an ASA or FTD firewall reload. No login is needed. It’s “only” a denial of service, but it’s your firewall, and it’s the second exploited ASA/FTD SSL VPN reload bug since August (CVE-2026-20349). Fixes shipped Oct 28.

What breaks: The device reloads. Cisco blames logic errors when secondary authentication is configured on a tunnel group, and says “a successful VPN login is not required to reach the affected processing path.” Cisco hasn’t said who is exploiting it, how widely, or against whom. The bug came out of a TAC case.

Who’s hit: ASA and FTD with SSL VPN enabled on an interface (webvpn enable <interface>) and secondary authentication on a reachable tunnel group. With tunnel-group-list enable, check every tunnel group. Without it, check DefaultWEBVPNGroup, because turning the list off doesn’t remove that exposure. Cloud-delivered Firewall, cdFMC, Secure Access and FMC itself aren’t affected.

First fixed releases:

  • ASA: 9.16.4.104 (9.16 and earlier), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 or 9.24.10.1.
  • FTD: 7.0.11 (7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1.

Run your version through Cisco’s Software Checker so you land on a release that also covers the other recent ASA/FTD advisories.

If you can’t upgrade tonight: Cisco lists no workaround, only a mitigation, and both versions of it cost you something:

  • If DefaultWEBVPNGroup doesn’t use secondary auth, turn off the group list with no tunnel-group-list enable. Users then have to know which connection profile to use.
  • If it does, remove secondary authentication with no secondary-authentication-server-group. That weakens your VPN login, so treat it as a short-term trade.

Sources: Cisco advisory, SecurityWeek, BleepingComputer, CISA KEV, Oct 29.

Sources

More from October 2026 patch cycle