CVE-2026-76418: Cisco ASA and FTD SSL VPN flaw under active exploit crashes firewalls remotely

CoeLab Real-World Impact: 97/100 — Urgent. Editorial score v1.0. Evidence checked 2026-10-30T09:10:17.145145+00:00. CVSS and EPSS are separate measures, not this editorial score.

Rating breakdown: exploitation: 30, reachability: 25, consequences: 22, operational relevance: 20.

Who is affected

This vulnerability affects Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software, but only when three conditions line up. First, the device runs a vulnerable release. Second, the remote access SSL VPN login service is reachable. Third, secondary authentication is configured on a tunnel group. If any one of those is absent, Cisco's advisory indicates the known affected processing path is not reached.

Cisco's CVE record lists specific affected branches, including ASA releases in the 9.16 line (for example 9.16.1 through 9.16.2.14) and FTD releases in the 7.0 and 7.2 lines (for example 7.0.0 through 7.0.3 plus 7.2.0). The record's enumeration is not exhaustive of every vulnerable build; Cisco's Software Checker is the tool the advisory points to for confirming whether a specific installed release is vulnerable and for finding the first fixed release on that branch.

Configuration matters as much as version. The advisory gives a concrete self-check: if the running configuration contains the webvpn keyword with SSL VPN enabled on an interface, review tunnel groups for the secondary-authentication-server-group setting. That check must include the default tunnel group, DefaultWEBVPNGroup, even when tunnel-group-list enable is not configured, because disabling the group list does not remove exposure if that default group uses secondary authentication. On FTD the setting is managed through the deployed remote access VPN policy in Secure Firewall Management Center (FMC) or Secure Firewall Device Manager (FDM), and Cisco recommends reviewing the resulting device running configuration rather than trusting the policy view alone.

Cisco states the vulnerability does not affect Cloud-delivered Firewall (CDFW), Cloud-delivered Firewall Management Center (cdFMC), Secure Access (CSA), or Secure FMC Software. The management plane is therefore outside the blast radius; the exposure is on the firewall/VPN device itself.

Real-world impact and exploitation evidence

The practical impact is remote, unauthenticated denial of service. A crafted request to the SSL remote access VPN service causes the device to reload. On a perimeter firewall that terminates site-to-site tunnels and remote access VPN, repeated crashes take with them everything the device fronts: VPN access for remote workers, branch connectivity, and any routed traffic that depends on the firewall's forwarding. The CVSS v3.1 vector in the CVE record (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base score 8.6) reflects exactly that shape: no privileges, no user interaction, low complexity, high availability damage with potential effects beyond the vulnerable component, and no confidentiality or integrity loss described.

This is not a purely theoretical bug. Cisco's advisory, initial public release on 2026-10-28, states that in October 2026 the Cisco Product Security Incident Response Team became aware of active exploitation of this vulnerability. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-29, with a required-action due date of 2026-11-01 under BOD 26-04. The KEV entry is federal-agency bookkeeping, but it is also a signal operators can borrow: a US civil-infrastructure mandate considers patching this within days, not weeks.

Two timing facts are worth keeping straight. The CVE record was published 2026-10-28 and last updated 2026-10-30; the KEV addition on 2026-10-29 came one day after initial disclosure, which is fast and suggests confirmed abuse rather than a slow coordination cycle. Separately, the underlying weakness was found by Eric Fernald during resolution of a Cisco TAC support case, per the advisory's source note, so this is a defect surfaced through customer support, not a responsibly staged bug bounty report.

One caution: exploitation evidence establishes that crashing devices is being done, not why. The advisory does not attribute the activity or describe target selection. Do not read 'actively exploited' here as anything more than Cisco PSIRT confirming abuse of the DoS mechanism.

Attack prerequisites

The attacker needs network reachability to the SSL VPN login service and no credentials at all. A successful VPN login is not required to reach the affected processing path, according to Cisco's advisory note for FTD, and the same logic applies to the ASA path: the crash can occur during the connection attempt itself, before any authentication succeeds.

The configuration gate is the main limit on exposure. Secondary authentication must be configured on a tunnel group within the scope described. Many enterprise deployments enable a second authentication server group for layered login, which is exactly why this bug is more dangerous than its availability-only CVSS impact suggests: the hardened setups are the targeted setups. The check also has a trap: whether or not a tunnel group list is presented on the login page, the DefaultWEBVPNGroup default group must be inspected, since Cisco explicitly notes that removing the group list does not remove exposure when the default group uses secondary authentication.

That combination - unauthenticated, remote, low complexity, no user interaction - plus a documented common configuration, is what makes repeated remote crashes plausible without insider access. What attackers gain is disruption and cover, not code execution; no confidentiality or integrity impact is claimed by Cisco or the CVSS vector.

Actions and fixes

Cisco has released software updates that address the vulnerability and recommends upgrading to a fixed release. From the advisory's fixed-software tables, first fixed releases are: ASA 9.16.4.104 (9.16 and earlier branches), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1 for the 9.24 branch; FTD 7.0.11 (7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1. Use the Cisco Software Checker linked in the advisory to map a specific installed release to its first fixed build rather than eyeballing the branch list.

With the BOD 26-04 due date of 2026-11-01, patching inside the window is the primary action. If patching must wait, the advisory documents a mitigation: disable secondary authentication on the tunnel groups in scope. Two cases apply. If DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel group list with no tunnel-group-list enable, accepting that users will no longer pick a connection profile from a list and must know their profile name. If DefaultWEBVPNGroup does use secondary authentication, remove it with no secondary-authentication-server-group. Cisco is explicit about the trade-off: removing secondary authentication lowers the security posture of the remote access VPN. That means the mitigation trades one risk for another - known remote crashes versus weaker login controls - so it is a bridge to the patch, not an endpoint.

Because the crash is a reload, devices that reboot cleanly lose only time; devices that do not, or that crash during a maintenance window, amplify the cost. For internet-facing VPN endpoints under active exploitation, treat the upgrade as emergency change. For purely internal VPN endpoints, the advisory's exposure assessment still applies, but the urgency is proportionally lower because the attacker needs reachability to the service. Cisco notes CDFW, cdFMC, CSA, and Secure FMC are not affected, so teams should not spend schedule on those components for this advisory.

Uncertainty and what could change

Several facts are established by primary sources and several are not. Established: the affected products and configuration scope, the DoS reload mechanism, active exploitation as confirmed by Cisco PSIRT in October 2026, the fixed releases, and the KEV entry with its deadline. Not established by the sources we checked: which actors are exploiting the flaw, whether any data compromise accompanies the DoS (Cisco and the CVSS vector describe none), and whether devices outside the enumerations in the CVE record are affected - the advisory deliberately defers that question to the Software Checker.

The mitigation path has its own uncertainty. Cisco tested the secondary-authentication mitigation in a test environment and reports it successful, while cautioning that customers must judge applicability and impact in their own deployments. Environments that rely on the second authentication factor for compliance may find the mitigation operationally unacceptable, which strengthens the case for expedited patching instead.

Expect the picture to sharpen. EPSS for this CVE was 0.0057 (about the 47th percentile) as of 2026-10-29, which is low and illustrates why EPSS and KEV can disagree: EPSS is a probability model, not a proof register, and confirmed exploitation via KEV outranks a low probability score. If CISA updates required action dates, if Cisco publishes additional affected branches, or if researchers connect this bug to a broader campaign, the urgency picture changes and this analysis should be revisited. None of that is required reading today; the patch first, mitigate second order of operations stands.

Sources and evidence date

Primary evidence for this analysis comes from Cisco's security advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 (initial public release 2026-10-28, checked 2026-10-30) covering the vulnerability description, affected configuration scope, fixed software table, active exploitation statement, mitigation, and credit to the reporter; the CVE record for CVE-2026-76418 (published 2026-10-28, updated 2026-10-30) providing affected version enumeration and the CVSS v3.1 vector and base score; and CISA's Known Exploited Vulnerabilities catalog (catalog version 2026.10.29) for the 2026-10-29 KEV addition, its required-action due date of 2026-11-01, and the CWE-690 classification. Links to each are in the source list below.

The CoeLab Real-World Impact score for this candidate is 97/100, labeled Urgent, with components exploiting public exploitation evidence (30), network reachability with no privileges and low complexity (25), consequences from the published 8.6 CVSS base (22), and operational relevance of the edge firewall category (20). The score's limits matter: it is a heuristic editorial composite, not CVSS or EPSS, its operational-relevance term is a category match rather than a measured installed base, and its exploitation component counts the KEV entry and vendor-confirmed abuse as evidence of exploitation, not of exploit volume or target characteristics. A device that is unexposed or not using secondary authentication may have no practical risk despite a high catalog score; the score is a prioritization aid for review, never a substitute for checking your own configuration and running versions.

Primary-source links

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75

https://www.cve.org/CVERecord?id=CVE-2026-76418

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76418

AI-assisted research and drafting, with a separate model editorial review. CoeLab ratings are editorial judgments, not a substitute for checking your own versions and vendor advisories. Methodology: https://thecoelab.com/blog/security/methodology