What’s Vulnerable › Vulnerabilities
CVE-2026-76418: Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
- Severity: high (CVSS 8.6 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2026-10-29
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-28 · updated 2026-10-30
- Weakness: CWE-690
Description
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Summary
CVE-2026-76418 is a high-severity (CVSS 8.6) logic flaw in the Remote Access SSL VPN service of Cisco ASA and FTD Software, triggered when secondary authentication is configured on a tunnel group. An unauthenticated remote attacker can send a crafted request during SSL VPN connection to force the device to reload, causing a denial of service. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation reported, so internet-exposed VPN gateways are at immediate risk. Apply Cisco's vendor mitigations or patched releases per CISA BOD 26-04 guidance, and discontinue use if mitigations are unavailable.
CVE-2026-76418 ثغرة عالية الخطورة (CVSS 8.6) ناتجة عن أخطاء منطقية في خدمة Remote Access SSL VPN في برمجيات Cisco ASA وFTD عند تكوين المصادقة الثانوية على مجموعة النفق. يمكن لمهاجم بعيد غير مصادق عليه إرسال طلب مصمم أثناء الاتصال بـ SSL VPN لإجبار الجهاز على إعادة التحميل والتسبب في حجب الخدمة. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة الاستغلال مع تقارير عن استغلال نشط، ما يعرض بوابات VPN المكشوفة على الإنترنت لخطر مباشر. طبّق إجراءات التخفيف أو الإصدارات المصححة وفق توجيه CISA BOD 26-04، وأوقف استخدام المنتج إذا لم تتوفر المعالجات.
Affected products
- Cisco ASA Software: before 9.16.4.104; from 9.18 before 9.18.4.96; from 9.19 before 9.20.4.50; from 9.22 before 9.22.3.200; from 9.23 before 9.23.1.48; from 9.24.1 before 9.24.1.27 — fixed in 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27
- Cisco Firepower Threat Defense Software: before 7.0.11; from 7.2.0 before 7.2.13; from 7.3.0 before 7.4.9; from 7.6.0 through 7.6.7; from 7.7.0 before 7.7.14; from 10.0.0 before 10.0.3 — fixed in 7.0.11, 7.2.13, 7.4.9, 7.7.14, 10.0.3
- Cisco ASA Software: 9.16.1, 9.16.1.28, 9.16.2, 9.16.2.3, 9.16.2.7, 9.16.2.11 (+136)
- Cisco Firepower Threat Defense Software: 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.2.0 (+61)
How to fix
Upgrade to a fixed version: Cisco ASA Software 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200; Cisco Firepower Threat Defense Software 7.0.11, 7.2.13, 7.4.9, 7.7.14. Check the vendor advisory for mitigations.
In the news
- Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
- Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
- Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76418
Get alerted when CVE-2026-76418 or the next vulnerability affects your stack