Summary
- CVE-2026-76418 can interrupt affected ASA and FTD VPN services without authentication.
- Cisco confirms exploitation, and CISA added the flaw to its exploited-vulnerability catalogue.
- Exposure requires particular SSL VPN and secondary-authentication configurations.
Cisco has issued security updates for an actively exploited vulnerability affecting certain ASA and Secure Firewall Threat Defense installations. CVE-2026-76418 can let a remote, unauthenticated attacker cause a firewall to reload when the device is configured to offer SSL remote-access VPN services with secondary authentication in an affected tunnel group.
Cisco rates the issue high severity, with a CVSS score of 8.6. The weakness involves logic errors in the VPN connection path; specially crafted requests can reach the vulnerable processing code before a successful VPN login. A resulting restart interrupts the device’s availability, including the connections it serves. The described impact is denial of service, not remote code execution or evidence that the attacker obtains firewall configuration data.
Exposure depends on the actual VPN configuration as well as the installed software version. Cisco describes conditions involving an enabled SSL VPN interface and secondary-authentication settings in the relevant tunnel group. Its advisory also explains why disabling a displayed group list does not necessarily remove exposure when the default connection profile continues using secondary authentication. Configuration audits therefore require examining the underlying policy instead of assuming that an apparently simplified login page is safe.
Fixed releases are available for affected ASA and FTD branches, and Cisco recommends upgrading. The vendor says there is no workaround that addresses the vulnerability directly, although disabling secondary authentication can mitigate the affected path. Such a change can weaken the intended access-control posture, making it unsuitable as an unexamined default. The released fixes avoid trading an availability risk for reduced authentication assurance.
NHS England published a cyber alert on 29 October identifying affected software branches and their corrected versions, identifying the same affected software for organisations using remote-access appliances in Britain. An exposed VPN gateway may sit on the route used by clinical staff, suppliers, engineers or outsourced support providers. An unexpected restart can disrupt access even when internal systems and credentials have not been compromised.
Cisco says its security response team became aware of active exploitation in October 2026. The advisory does not identify attackers, victims or the number of incidents. CISA added the issue to its Known Exploited Vulnerabilities catalogue on 29 October, and the Canadian Centre for Cyber Security separately warned about the flaw. The confirmed attack scenario remains an availability disruption through a particular SSL VPN configuration; other Cisco vulnerabilities disclosed in October have different CVEs, impact and affected products.
As a boundary device, an ASA or FTD firewall can affect more than one application. VPN sessions, remote administration and other network paths may rely on the same hardware or virtual appliance. Maintenance planning has to consider version compatibility and high-availability arrangements, but continuity measures alone cannot eliminate a crashable processing path on an unpatched instance. An attacker need not defeat a user credential to trigger the availability failure described by Cisco.
When a firewall repeatedly restarts, the available evidence may centre on lost sessions and device availability rather than stolen credentials. Repeated firewall reloads could appear as availability failures, lost VPN sessions or unexpected device restarts rather than the authentication anomalies associated with stolen credentials. Cisco’s description of the affected path makes secondary authentication a configuration prerequisite, but it should not be interpreted as a reason to abandon multifactor protections across an enterprise. The mitigation described in the advisory may alter authentication behaviour, whereas the fixed software directly addresses the crash condition.
Cisco’s advisory identifies the affected VPN conditions and lists corrected releases for the ASA and FTD software branches. Organisations can use those details to determine whether a reachable service and the required secondary-authentication configuration coexist on an unpatched appliance. Cisco has not linked this specific vulnerability to stolen customer data or remote code execution. The observed exploitation makes service continuity, firmware version and tunnel-group configuration immediate considerations.
