Cisco ASA and FTD CVE-2026-76418: Patch and Check VPN Exposure
CVE-2026-76418 affects certain Cisco Secure Firewall ASA and FTD deployments that use remote access SSL VPN with secondary authentication. Cisco says attackers have actively exploited this denial-of-service flaw. A successful attack can reload the firewall and interrupt VPN or other traffic. Read Cisco’s October 28 advisory.
What CVE-2026-76418 means for a small organization
A firewall may also be the gateway that staff use to reach business applications remotely. An unexpected reload can disrupt that access. This is an availability issue; the cited advisory does not say this flaw gives an attacker remote code execution or data access. NVD’s October 28 record describes an unauthenticated attacker sending a crafted SSL VPN connection request.
CISA’s Known Exploited Vulnerabilities catalog added the CVE on October 29, 2026. Its November 1 remediation date concerns covered US federal agencies, not a blanket legal deadline for private businesses. Cisco separately reports awareness of active exploitation in October 2026. Cisco advisory.
Check whether your Cisco ASA or FTD is exposed
Inventory Cisco ASA and FTD firewalls, including appliances managed by a provider. Record the running software version, which interfaces expose SSL remote access VPN, and the deployed tunnel-group configuration. Cisco says the flaw requires a vulnerable release, a reachable SSL remote access VPN login service, and secondary authentication in the relevant tunnel group. Cisco’s affected-products and configuration checks explain how to test these conditions.
For ASA, inspect the running configuration for webvpn and enable interface_name. If tunnel-group-list enable is present, inspect all tunnel groups, including DefaultWEBVPNGroup, for secondary-authentication-server-group. If the group list is absent or disabled, Cisco still directs you to check the default group. For FTD, inspect the deployed remote access VPN policy and resulting device configuration in FMC or FDM. Cisco’s configuration guidance.
CVE-2026-76418 fixed versions and patch steps
Cisco lists these first fixed ASA releases by branch: 9.16 and earlier → 9.16.4.104; 9.18 → 9.18.4.96; 9.20 → 9.20.4.50; 9.22 → 9.22.3.200; 9.23 → 9.23.1.48; 9.24 → 9.24.1.27 or 9.24.10.1. For FTD: 7.0 and earlier → 7.0.11; 7.2 → 7.2.13; 7.4 → 7.4.9; 7.6 → 7.6.7; 7.7 → 7.7.14; 10.0 → 10.0.3; 10.1 → 10.1.1. Check the current Cisco fixed-release table and Cisco Software Checker for your exact platform before scheduling a change.
Back up configuration, plan access and rollback, and upgrade to an appropriate fixed release. After maintenance, confirm the running version on every ASA or FTD node and verify the VPN still works. Do not rely on a downloaded package or a closed change ticket as proof of installation.
If you cannot patch immediately
Cisco says there is no workaround that addresses the flaw. It describes a temporary mitigation that disables secondary authentication on the relevant tunnel groups. This can lower remote-access security or change how users select their VPN profile, so assess the impact before using it and prioritize the fixed release. Cisco’s mitigation instructions distinguish the default group from user-configured groups; follow the applicable case rather than removing authentication blindly.
Verify service and investigate unexpected reloads
Review firewall uptime, crash or reload records, VPN connection logs, and monitoring alerts for unexplained interruptions. Preserve relevant logs and escalate suspicious events through your incident-response process. These are practical triage checks, not Cisco-published indicators that prove exploitation of this CVE. Patching prevents the known vulnerable path but cannot establish whether an earlier reload was malicious.
If your team needs help inventorying firewalls or validating remediation, Reliant System’s security review and remediation service can help scope the work. For a separate, authorized assessment of exposed systems, see our penetration-testing service.