MDR
Solutions
Partners
About
Resources
Affected Environment
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software running a vulnerable release, with the SSL remote access VPN login service reachable and secondary authentication configured in a tunnel group. A running configuration containing the webvpn keyword with SSL VPN enabled on at least one interface is vulnerable.
Threat Overview
CVE-2026-76418 (CVSS 8.6) allows an unauthenticated remote attacker to make an affected device reload unexpectedly, causing a denial-of-service condition.
Exposure Timeline
Report issued 29 October 2026. Cisco has released software updates.
Attack Surface
The Remote Access SSL VPN service on any interface where SSL VPN is enabled. On FTD, remote access VPN is enabled under Devices > VPN > Remote Access in Firewall Management Center, or under Remote Access VPN in Firewall Device Manager.
Technical Root Cause
Logic errors in the handling of connections when secondary authentication is configured for a tunnel group.
Exploitation Pathway
An unauthenticated attacker sends a crafted request when connecting to the SSL Remote Access VPN service, triggering the device reload.
Operational Impact
Unexpected device reloads disrupt VPN connectivity and any other network services that depend on the affected device.
Strategic Impact
Risk is rated High for large, medium and small government entities and for large, medium and small businesses.
Required Mitigation
Cisco has confirmed no workarounds, so upgrade to a fixed release after appropriate testing.
Cisco Secure Firewall ASA Software, first fixed release:
Cisco Secure FTD Software, first fixed release:
Incident Response Guidance
Check running configurations for the webvpn keyword and SSL VPN enabled on an interface to identify exposed devices. Keep vulnerability management tooling, perimeter and endpoint security products up to date, apply least privilege and enforce granular application control.
References
Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75: sec.cloudapps.cisco.com. CVE-2026-76418.
Trusted by clients worldwide
Led by human expertise and powered by the VisionX platform, we provide you with a 24/7 unbeatable Managed Detection & Response capability giving you transparent and consolidated security solutions.
.jpg)