# Cisco ASA/FTD: active exploitation can restart VPN devices Canonical: https://www.oktsec.com/radar/cisco-asa-ftd-cve-2026-76418 Publisher: Oktsec Language: en Published: 2026-10-29T17:53:35Z Updated: 2026-10-29T17:53:35Z Record reviewed: 2026-10-29T17:53:35Z Latest evidence check: 2026-10-29T17:53:35Z Disclosed: 2026-10-28 Cisco reports active exploitation of a flaw that can restart ASA/FTD devices without a successful VPN login. Exposure requires a vulnerable release, reachable SSL VPN and secondary authentication in the affected tunnel groups. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: Cisco confirms active exploitation. The affected SSL VPN configuration can be reached without logging in, allowing device restarts and loss of service. Prioritize correction on devices matching those conditions. - Evidence: Attacks confirmed - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: Cisco - Products: Secure Firewall ASA, Secure Firewall FTD - CVEs: CVE-2026-76418 - Vendor severity: CVSS 3.1 8.6 ## Technical overview A crafted VPN request can trigger a device restart. Cisco identifies availability impact; this advisory does not establish remote code execution. The flaw depends on secondary authentication and the reachable SSL VPN configuration. Cisco became aware of exploitation in October 2026. October 28 is the advisory publication date, not a confirmed date for the first attack. The correction lists below reproduce vendor branch alternatives. Download access and installation have not been verified. Use the vendor checker and supported upgrade path for the specific device. Cisco lists no workaround and separately documents conditional mitigations with security and functionality tradeoffs. ## Recommended response Use Cisco Software Checker to select and install the correction for the deployed branch. Verify the running release after maintenance. Relevant to: Operators of Cisco ASA or FTD with SSL remote access VPN enabled. ## CVE attribution - CVE-2026-76418: Cisco — Secure Firewall ASA, Secure Firewall FTD; CVSS 3.1: 8.6. [Source](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75) ## Affected systems and fixes ### Cisco Secure Firewall ASA Affected: Vulnerable branch with reachable SSL VPN and secondary authentication in the affected tunnel groups. Fixed release / action: 9.16.4.104; 9.18.4.96; 9.20.4.50; 9.22.3.200; 9.23.1.48; 9.24.1.27; 9.24.10.1 ### Cisco Secure Firewall FTD Affected: Vulnerable branch with reachable SSL VPN and secondary authentication in the affected tunnel groups. Fixed release / action: 7.0.11; 7.2.13; 7.4.9; 7.6.7; 7.7.14; 10.0.3; 10.1.1 Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.10.28 Checked: 2026-10-28T23:52:19.770Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-10-27T15:30:57.206Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2026-76418 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-10-27T15:30:57.206Z. ## Response checklist 1. **Inspect the deployed VPN configuration** — Check the running release, SSL VPN reachability and secondary-authentication-server-group. With tunnel-group-list enabled, inspect all groups, including DefaultWEBVPNGroup and profiles absent from the login list. Without the list, inspect DefaultWEBVPNGroup. 2. **Choose the correction for the installed branch** — Use the advisory matrix and Cisco Software Checker. The versions below are branch alternatives, not a single upgrade path. Check platform compatibility and maintenance requirements before installation. 3. **Assess temporary changes before altering authentication** — Do not remove secondary authentication as a generic fix. Cisco describes configuration-specific mitigations and warns that removing secondary authentication lowers security. Evaluate any temporary change against the actual policy; prioritize the software correction. 4. **Verify the running release and investigate interruptions** — Record the running version after maintenance and confirm VPN operation. Oktsec recommends reviewing unexpected restarts and service interruptions; a reboot alone does not prove exploitation. ## Relevance to AI environments No specific AI mechanism is established. Oktsec recommends checking operational dependencies on the affected VPN, including access used to manage agent infrastructure. ## Sources - [Cisco ASA/FTD: active exploitation can restart VPN devices](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75) — Cisco; Vendor notice; checked 2026-10-29T17:42:53Z ## Editorial record - 2026-10-29T17:53:35Z: Added the vendor advisory, affected configuration and response steps. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/cisco-asa-ftd-cve-2026-76418) · [Build a response plan](https://www.oktsec.com/radar/cisco-asa-ftd-cve-2026-76418#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=cisco-asa-ftd-cve-2026-76418&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=cisco-asa-ftd-cve-2026-76418&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.