[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

official (Cisco PSIRT advisory, Oct 28; Cisco says it is aware of active exploitation); not yet in CISA KEV as of catalog 2026.10.28

Cisco patches an actively exploited ASA and FTD bug that lets an unauthenticated attacker reload the firewall through the SSL VPN login when secondary authentication is configured (CVE-2026-76418)

Cisco published the advisory on Oct 28 and says its PSIRT became aware of active exploitation this month. A logic error in the Remote Access SSL VPN service lets a remote, unauthenticated attacker send a crafted request while connecting to the VPN and force the device to reload. A successful VPN login is not needed. CVSS 8.6, bug CSCwx26625. The flaw was found while resolving a TAC support case.

  • Exposed when: SSL VPN is enabled on an interface (webvpn / enable <interface>) and a tunnel group uses secondary-authentication-server-group. If tunnel-group-list enable is set, every tunnel group counts, including DefaultWEBVPNGroup, even ones not shown on the login page. Without the group list, check DefaultWEBVPNGroup.
  • First fixed ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 / 9.24.10.1. FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1.
  • Not affected: Cloud-delivered Firewall, cdFMC, Secure Access and Secure FMC.

What to do: upgrade internet-facing ASA and FTD VPN head-ends first. There is no workaround, but Cisco lists a mitigation: disable the tunnel group list if DefaultWEBVPNGroup has no secondary authentication, or remove secondary authentication, which weakens VPN login. Watch for unexpected reloads and crash files on VPN gateways.

Sources: Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75: ASA and FTD Remote Access SSL VPN Tunnel DoS, CVE-2026-76418 (Oct 28)