Cisco ASA and FTD Remote Access SSL VPN denial of service actively exploited (CVE-2026-76418)

What happened

The remote access SSL VPN service in Cisco Secure Firewall ASA Software and FTD Software has a logic error that can be triggered when secondary authentication is configured on a tunnel group. An unauthenticated attacker can send a crafted request while connecting to the SSL remote access VPN and cause the device to reload unexpectedly. The result is a denial of service for VPN users, not remote code execution or data theft. Cisco rates this High with a CVSS 3.1 score of 8.6: network attack vector, low complexity, no privileges, no user interaction, scope changed, and high availability impact.

Exploitation is being reported by multiple sources. Cisco PSIRT says it became aware of active exploitation in October 2026 and strongly recommends upgrading to a fixed software release. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 29 October 2026, and ENISA EUVD records exploitation since 29 October 2026. Cisco has not published exploit details.

Who is affected

These Cisco Secure Firewall software versions are listed as affected: ASA Software 9.16.1, 9.16.1.28, 9.16.2, 9.16.2.3, 9.16.2.7, 9.16.2.11, 9.16.2.13 and 9.16.2.14; FTD Software 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.0.2.1, 7.0.3 and 7.2.0.

The vulnerability is relevant where remote access SSL VPN is enabled and secondary authentication is configured on a tunnel group, including the DefaultWEBVPNGroup. The vulnerable service is reachable over the network without credentials.

What to do now

1. Upgrade to a fixed software release. Cisco states that fixed software is available and strongly recommends upgrading; the specific fixed release numbers are not listed on this page, so confirm the right release for your ASA or FTD version in Cisco's advisory.

1. If you cannot patch immediately, apply Cisco's mitigation for secondary authentication. If DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel group list in WebVPN configuration mode with no tunnel-group-list enable. If DefaultWEBVPNGroup uses secondary authentication, remove it with no secondary-authentication-server-group. Cisco notes the second option lowers the security posture for remote access VPN; test and assess applicability in your environment.

1. Treat any unexpected reload of an affected VPN device as a potential exploitation attempt and investigate before returning it to service.

How to detect it

Monitor ASA and FTD devices on affected versions for unexpected reloads, particularly where remote access SSL VPN and secondary authentication are in use. Correlate reloads with SSL VPN connection attempts from unusual source addresses, and review authentication logs for anomalies around the connection time. Cisco's advisory does not provide specific indicators of compromise for this vulnerability.

Beyond the patch

Beyond patching, the active exploitation of a pre-authentication denial-of-service flaw in a VPN termination point is a resilience issue, not just an availability issue: an attacker can disrupt remote access by forcing reloads. Managed Detection & Response (MDR) can watch for the unexpected reloads and exploitation attempts, and Virtual CISO Services (vCISO) can help identify which VPN services are exposed and where secondary authentication configurations sit. Both are the kind of controls that make the next VPN flaw less disruptive.