# Cisco ASA and FTD zero-day CVE-2026-76418 exploited to crash SSL VPN firewalls · pwn.watch > Cisco patched CVE-2026-76418 (CVSS 8.6), a denial-of-service bug in the Remote Access SSL VPN service of Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Logic errors when secondary authentication is configured on a tunnel group let an unauthenticated, remote attacker send a crafted request while connecting to the SSL VPN and make the device reload; a successful VPN login is not needed. Cisco PSIRT became aware of active exploitation in October 2026 and strongly recommends upgrading. Devices are affected when webvpn is enabled on an interface and a tunnel group (including DefaultWEBVPNGroup) uses secondary-authentication-server-group. There is no workaround, but disabling secondary authentication mitigates it. Shadowserver tracks more than 51,000 internet-exposed ASA SSL VPN devices. Page: https://pwn.watch/i/cisco-asa-ftd-ssl-vpn-dos-zero-day-cve-2026-76418 · generated 2026-10-29T12:55:23.617Z ## Status - Severity: high · status: live · patch: patched - Product: Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) - Started: 2026-10-28 - CVEs: CVE-2026-76418 - Affected: Cisco ASA Software before 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 and 9.24.1.27 (per train) with SSL remote access VPN enabled and secondary authentication on a tunnel group; Cisco FTD Software before 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1 (per train) with the same configuration - Fixed in: ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27; FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1; Not affected: Cloud-delivered Firewall, cdFMC, Secure Access and Secure FMC Software ## Follow this incident - RSS (one item per update): https://pwn.watch/i/cisco-asa-ftd-ssl-vpn-dos-zero-day-cve-2026-76418/feed.xml - JSON Feed: https://pwn.watch/i/cisco-asa-ftd-ssl-vpn-dos-zero-day-cve-2026-76418/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/cisco-asa-ftd-ssl-vpn-dos-zero-day-cve-2026-76418.json - This file: https://pwn.watch/i/cisco-asa-ftd-ssl-vpn-dos-zero-day-cve-2026-76418/llms.txt ## Updates (newest first) - 2026-10-29: BleepingComputer reports the zero-day; Shadowserver tracks more than 51,000 internet-exposed Cisco ASA SSL VPN devices. (https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/) - 2026-10-28: Cisco publishes advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418 with fixed ASA and FTD releases, saying PSIRT became aware of active exploitation in October 2026. (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75) ## Fix brief # Security brief: Cisco ASA and FTD zero-day CVE-2026-76418 exploited to crash SSL VPN firewalls Source: https://pwn.watch/i/cisco-asa-ftd-ssl-vpn-dos-zero-day-cve-2026-76418 · status: live · severity: high · updated Oct 29, 2026, 11:23 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Cisco patched CVE-2026-76418 (CVSS 8.6), a denial-of-service bug in the Remote Access SSL VPN service of Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Logic errors when secondary authentication is configured on a tunnel group let an unauthenticated, remote attacker send a crafted request while connecting to the SSL VPN and make the device reload; a successful VPN login is not needed. Cisco PSIRT became aware of active exploitation in October 2026 and strongly recommends upgrading. Devices are affected when webvpn is enabled on an interface and a tunnel group (including DefaultWEBVPNGroup) uses secondary-authentication-server-group. There is no workaround, but disabling secondary authentication mitigates it. Shadowserver tracks more than 51,000 internet-exposed ASA SSL VPN devices. Severity detail: Cisco rates it High (CVSS 8.6) and confirms exploitation in the wild; unauthenticated remote reload of the firewall - Product: Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) - CVE / advisory ids: CVE-2026-76418 ## Affected versions - Cisco ASA Software before 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 and 9.24.1.27 (per train) with SSL remote access VPN enabled and secondary authentication on a tunnel group - Cisco FTD Software before 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1 (per train) with the same configuration ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 - FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1 - Not affected: Cloud-delivered Firewall, cdFMC, Secure Access and Secure FMC Software After upgrading, re-run the checks above and redeploy/restart the affected services. ## Latest updates - Oct 29, 2026: BleepingComputer reports the zero-day; Shadowserver tracks more than 51,000 internet-exposed Cisco ASA SSL VPN devices. - Oct 28, 2026: Cisco publishes advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418 with fixed ASA and FTD releases, saying PSIRT became aware of active exploitation in October 2026. ## Advisories - [Cisco Secure Firewall ASA and FTD Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75) (Cisco) - [NVD: CVE-2026-76418](https://nvd.nist.gov/vuln/detail/CVE-2026-76418) (NVD) ## Write-ups & news - [New Cisco firewall zero-day exploited to crash SSL VPN devices](https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/) - [Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls](https://thehackernews.com/2026/10/cisco-patches-actively-exploited-asa.html) --- Machine-readable: https://pwn.watch/i/cisco-asa-ftd-ssl-vpn-dos-zero-day-cve-2026-76418.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.