---
title: Tip: before you schedule the ASA/FTD upgrade, list which VPN tunnel groups use secondary authentication; those boxes are the exposed ones | ctxsec
url: https://ctxsec.com/items/tip-asa-ftd-find-secondary-auth-tunnel-groups
description: ""
status: "guidance (based on Cisco advisory for CVE-2026-76418, Oct 28)"
published: 2026-10-29
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-asa-ftd-find-secondary-auth-tunnel-groups.md)

guidance (based on Cisco advisory for CVE-2026-76418, Oct 28)

2026-10-29

### Tip: before you schedule the ASA/FTD upgrade, list which VPN tunnel groups use secondary authentication; those boxes are the exposed ones

CVE-2026-76418 only bites when SSL VPN is on and a tunnel group has secondary authentication. On ASA, run `show running-config tunnel-group` and look for `secondary-authentication-server-group`, then run `show running-config webvpn` to see whether `tunnel-group-list enable` is set (then every group matters, including `DefaultWEBVPNGroup`). On FTD, check the deployed remote access VPN policy in FMC or FDM. Patch those devices first, and keep reload and crash alerts on for VPN gateways, since a reload is what exploitation looks like.

Sources: [Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75: ASA and FTD Remote Access SSL VPN Tunnel DoS, CVE-2026-76418 (Oct 28)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75)