Cisco reports active exploitation of a flaw that can restart ASA/FTD devices without a successful VPN login. Exposure requires a vulnerable release, reachable SSL VPN and secondary authentication in the affected tunnel groups.
Who should check: Operators of Cisco ASA or FTD with SSL remote access VPN enabled.
Use Cisco Software Checker to select and install the correction for the deployed branch. Verify the running release after maintenance.
A crafted VPN request can trigger a device restart. Cisco identifies availability impact; this advisory does not establish remote code execution. The flaw depends on secondary authentication and the reachable SSL VPN configuration.
Cisco became aware of exploitation in October 2026. October 28 is the advisory publication date, not a confirmed date for the first attack.
The correction lists below reproduce vendor branch alternatives. Download access and installation have not been verified. Use the vendor checker and supported upgrade path for the specific device. Cisco lists no workaround and separately documents conditional mitigations with security and functionality tradeoffs.
| Product | Affected | Fixed release / action |
|---|---|---|
| Cisco Secure Firewall ASA | Vulnerable branch with reachable SSL VPN and secondary authentication in the affected tunnel groups. | 9.16.4.1049.18.4.969.20.4.509.22.3.2009.23.1.489.24.1.279.24.10.1 |
| Cisco Secure Firewall FTD | Vulnerable branch with reachable SSL VPN and secondary authentication in the affected tunnel groups. | 7.0.117.2.137.4.97.6.77.7.1410.0.310.1.1 |
Use the guidance for your product and release branch. Confirm distribution backports with the vendor; the product name alone does not establish exposure.
Cisco confirms active exploitation. The affected SSL VPN configuration can be reached without logging in, allowing device restarts and loss of service. Prioritize correction on devices matching those conditions.
No specific AI mechanism is established. Oktsec recommends checking operational dependencies on the affected VPN, including access used to manage agent infrastructure.
Added the vendor advisory, affected configuration and response steps.
Use this checklist to decide whether the advisory affects your systems, record what your team does and share the result. Radar does not scan or verify your environment.
Changes save automatically in this browser. They are not synced with your team or sent to Oktsec.
Check affected systems and versions, then record your decision below. If you are unsure, choose “Needs verification”.
Name the system and person or team handling the work. Update each action as you go; add a ticket reference or notes to explain what was checked.
Check the running release, SSL VPN reachability and secondary-authentication-server-group. With tunnel-group-list enabled, inspect all groups, including DefaultWEBVPNGroup and profiles absent from the login list. Without the list, inspect DefaultWEBVPNGroup.
Use the advisory matrix and Cisco Software Checker. The versions below are branch alternatives, not a single upgrade path. Check platform compatibility and maintenance requirements before installation.
Do not remove secondary authentication as a generic fix. Cisco describes configuration-specific mitigations and warns that removing secondary authentication lowers security. Evaluate any temporary change against the actual policy; prioritize the software correction.
Record the running version after maintenance and confirm VPN operation. Oktsec recommends reviewing unexpected restarts and service interruptions; a reboot alone does not prove exploitation.
Download a Markdown file with your decision, action status, notes and source links. Share it with your team or attach it to a ticket.
Compare the running version and configuration with the vendor guidance.
| Product | Affected | Fixed release / action |
|---|---|---|
| Cisco Secure Firewall ASA | Vulnerable branch with reachable SSL VPN and secondary authentication in the affected tunnel groups. | 9.16.4.1049.18.4.969.20.4.509.22.3.2009.23.1.489.24.1.279.24.10.1 |
| Cisco Secure Firewall FTD | Vulnerable branch with reachable SSL VPN and secondary authentication in the affected tunnel groups. | 7.0.117.2.137.4.97.6.77.7.1410.0.310.1.1 |
Confirm distribution backports with the vendor. A matching product alone does not establish exposure.
Cisco confirms active exploitation. The affected SSL VPN configuration can be reached without logging in, allowing device restarts and loss of service. Prioritize correction on devices matching those conditions.
Prioritization criteriaCatalog 2026.10.28 · Checked Oct 28, 2026 UTC
No matching CVE appears in the reviewed catalog snapshot. This does not establish that exploitation has not occurred. Check the incident sources and vendor guidance.
| Product / CVE | Attack evidence | Source guidance |
|---|---|---|
| Secure Firewall ASA / Secure Firewall FTDCVE-2026-76418 | Attacks confirmed Reported by the sources linked in this advisory. | Cisco sourceReview affected systems |
Forecast unavailable. This is not a zero score.
FIRST EPSS · Checked 2026-10-27 15:30 UTC
Priority applies to the parent advisory, not separately to every product or CVE. Each row shows only the evidence attributed to that CVE. Missing attack evidence does not mean a vulnerability is safe to ignore. Your environment has not been scanned.
Technical facts come from these sources. Response priorities and recommended actions are Oktsec’s analysis.
| Product / service | Secure Firewall ASA, Secure Firewall FTDCisco |
|---|---|
| CVE | CVE-2026-76418 |
| Exploitation evidence | Attacks confirmed |
| Access required | Application or configuration dependent |
| Vendor severity | 8.6CVSS 3.1 |
| Severity by CVE | CVE-2026-76418 · 8.6 · CVSS 3.1 |
| Fix / response | Fix availableAffected versions and fixes |
No specific AI mechanism is established. Oktsec recommends checking operational dependencies on the affected VPN, including access used to manage agent infrastructure.