---
title: Cisco patches an actively exploited ASA and FTD bug that lets an unauthenticated attacker reload the firewall through the SSL VPN login when secondary authentication is configured (CVE-2026-76418) | ctxsec
url: https://ctxsec.com/items/cisco-asa-ftd-cve-2026-76418-ssl-vpn-dos-exploited
description: ""
status: "official (Cisco PSIRT advisory, Oct 28; Cisco says it is aware of active exploitation); not yet in CISA KEV as of catalog 2026.10.28"
published: 2026-10-29
---

> 

[← Cybersecurity News](/news) · [markdown](/items/cisco-asa-ftd-cve-2026-76418-ssl-vpn-dos-exploited.md)

official (Cisco PSIRT advisory, Oct 28; Cisco says it is aware of active exploitation); not yet in CISA KEV as of catalog 2026.10.28

2026-10-29

### Cisco patches an actively exploited ASA and FTD bug that lets an unauthenticated attacker reload the firewall through the SSL VPN login when secondary authentication is configured (CVE-2026-76418)

Cisco published the advisory on Oct 28 and says its PSIRT became aware of active exploitation this month. A logic error in the Remote Access SSL VPN service lets a remote, unauthenticated attacker send a crafted request while connecting to the VPN and force the device to reload. A successful VPN login is not needed. CVSS 8.6, bug CSCwx26625. The flaw was found while resolving a TAC support case.

- **Exposed when:** SSL VPN is enabled on an interface (`webvpn` / `enable <interface>`) and a tunnel group uses `secondary-authentication-server-group`. If `tunnel-group-list enable` is set, every tunnel group counts, including `DefaultWEBVPNGroup`, even ones not shown on the login page. Without the group list, check `DefaultWEBVPNGroup`.
- **First fixed ASA:** 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 / 9.24.10.1. **FTD:** 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1.
- **Not affected:** Cloud-delivered Firewall, cdFMC, Secure Access and Secure FMC.

**What to do:** upgrade internet-facing ASA and FTD VPN head-ends first. There is no workaround, but Cisco lists a mitigation: disable the tunnel group list if `DefaultWEBVPNGroup` has no secondary authentication, or remove secondary authentication, which weakens VPN login. Watch for unexpected reloads and crash files on VPN gateways.

Sources: [Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75: ASA and FTD Remote Access SSL VPN Tunnel DoS, CVE-2026-76418 (Oct 28)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75)