Tip: before you schedule the ASA/FTD upgrade, list which VPN tunnel groups use secondary authentication; those boxes are the exposed ones

guidance (based on Cisco advisory for CVE-2026-76418, Oct 28)2026-10-29

Tip: before you schedule the ASA/FTD upgrade, list which VPN tunnel groups use secondary authentication; those boxes are the exposed ones

CVE-2026-76418 only bites when SSL VPN is on and a tunnel group has secondary authentication. On ASA, run show running-config tunnel-group and look for secondary-authentication-server-group, then run show running-config webvpn to see whether tunnel-group-list enable is set (then every group matters, including DefaultWEBVPNGroup). On FTD, check the deployed remote access VPN policy in FMC or FDM. Patch those devices first, and keep reload and crash alerts on for VPN gateways, since a reload is what exploitation looks like.

Sources: Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75: ASA and FTD Remote Access SSL VPN Tunnel DoS, CVE-2026-76418 (Oct 28)