Cisco VPN flaw under attack can force firewall reboots
A Cisco VPN flaw tracked as CVE-2026-76418 is being actively exploited to force vulnerable Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) devices to restart. Cisco has released security updates, commonly called patches, for the affected software. The company says an attacker can trigger the problem remotely without first signing in, causing a denial-of-service (DoS) condition that makes the device or its service unavailable.
The vulnerability has a severity score of 8.6 under the Common Vulnerability Scoring System (CVSS), a standard scale used to describe the seriousness of security flaws. It affects the Remote Access Secure Sockets Layer virtual private network (SSL VPN) service, which lets users connect remotely to an organisation's network. According to Cisco, faulty logic is reached when secondary authentication, an additional identity check, is configured for a tunnel group, which is a profile containing settings for a category of VPN connections. A specially prepared connection request can then make the network security device reload unexpectedly. A successful VPN login is not required to reach the vulnerable processing path.
A device is exposed only when three conditions apply. It must be running a vulnerable ASA or FTD release, its SSL remote access VPN login service must be reachable, and secondary authentication must be configured within the tunnel group settings. This combination is important for administrators assessing risk because merely running one of the listed software releases does not establish that every device has the vulnerable configuration.
Cisco advises administrators with tunnel-group-list enable configured to examine every tunnel group for secondary-authentication-server-group, including the built-in DefaultWEBVPNGroup. If tunnel-group-list enable is missing or has been removed with the no tunnel-group-list enable command, administrators must still inspect DefaultWEBVPNGroup. Turning off the group list does not remove the exposure when that default group continues to use secondary authentication.
For ASA Software, Cisco lists the fixed releases as 9.16.4.104 for 9.16 and earlier, 9.18.4.96 for 9.18, 9.20.4.50 for 9.20, 9.22.3.200 for 9.22, and 9.23.1.48 for 9.23. Systems on the 9.24 line can move to either 9.24.1.27 or 9.24.10.1. Administrators should compare the complete installed version number with the relevant fixed release rather than relying only on the first two numbers.
The fixed FTD Software releases are 7.0.11 for 7.0 and earlier, 7.2.13 for 7.2, 7.4.9 for 7.4, 7.6.7 for 7.6, 7.7.14 for 7.7, 10.0.3 for 10.0, and 10.1.1 for 10.1. Cisco also tells FTD administrators to review both the deployed remote access VPN policy and the device's current running configuration through Cisco Secure FMC Software or Cisco Secure FDM, the management software used to inspect and deploy device settings.
Where an immediate update is not possible, Cisco provides configuration-based temporary mitigations. Administrators can turn off the tunnel group list when DefaultWEBVPNGroup does not use secondary authentication. Alternatively, they can disable secondary authentication on affected user-configured tunnel groups or on DefaultWEBVPNGroup. These changes can alter how remote users authenticate, so organisations should review their deployed VPN policy and resulting device configuration when applying them.
Cisco says it became aware of active exploitation in October 2026. It has not provided details about when the attacks started, who is carrying them out or how broadly the vulnerability has been targeted. The demonstrated outcome described by the advisory is a forced restart and resulting service outage, not an assertion that attackers can sign in, steal data or execute software through this flaw.
For hosting providers, businesses and website operators, the practical concern is availability: a restart of a VPN gateway can interrupt the remote access that administrators depend on to manage internal systems and online services. For organisations that need help managing this kind of exposure, AEU-I provides security-first IT, infrastructure and consulting. Administrators responsible for ASA or FTD deployments should identify reachable SSL VPN services, inspect the relevant authentication settings and move to the applicable fixed release.