What is CVE-2026-76418?

It is a denial-of-service flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software. Cisco rates it High with a CVSS base score of 8.6 and says an unauthenticated, remote attacker can send a crafted request that makes the device reload.

Is it being exploited?

Yes. Cisco's advisory states that in October 2026 its Product Security Incident Response Team became aware of active exploitation. Cisco has not published details on who is behind it or how widespread it is.

How do I know if my firewall is exposed?

Cisco says a device is affected if it runs a vulnerable release, the SSL remote access VPN login service is reachable, and secondary authentication is configured in a tunnel group. On ASA, look for the webvpn keyword and check every tunnel group, including DefaultWEBVPNGroup, for secondary-authentication-server-group.

Is there a workaround?

Cisco says no workaround addresses the flaw, but there is a mitigation: disable secondary authentication on any user-configured tunnel group or on DefaultWEBVPNGroup. If the default group does not use it, you can also disable the tunnel group list. Cisco still recommends upgrading.

Which versions fix it?

ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1. FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. Confirm your exact release with Cisco's Software Checker.

Cisco ASA FTD CVE-2026-76418: Patch the VPN

If your office, shop or clinic uses a Cisco ASA or Secure Firewall (FTD) appliance for staff remote access, check it this week. On 28 October 2026 Cisco published a security advisory for CVE-2026-76418, a flaw that lets someone on the internet make the firewall restart, and Cisco says it is already being exploited.

The short answer

The flaw sits in the Remote Access SSL VPN service. An unauthenticated attacker can send a crafted request and cause the device to reload, which is a denial of service: your VPN drops, and anything that relies on that firewall can go down with it. Cisco rates it High, CVSS 8.6. The advisory says Cisco's incident response team learned of active exploitation in October 2026. Cisco has not said who is exploiting it or how many devices are hit, so treat those details as unknown.

This is an availability problem, not a reported takeover. Cisco's advisory describes a reload, not code execution or data theft.

Are you affected?

Cisco says all three of these must be true:

The device runs a vulnerable release of ASA or FTD software.
The SSL remote access VPN login service is reachable. On ASA this means the running configuration contains webvpn with SSL VPN enabled on at least one interface.
Secondary authentication is configured in a tunnel group.

Two details catch people out. First, the check is not limited to profiles shown on the login page. Second, turning off the tunnel group list does not remove the exposure if the default group, DefaultWEBVPNGroup, uses secondary authentication. On FTD, review the deployed remote access VPN policy in Secure Firewall Management Center or Device Manager. Cisco notes a successful VPN login is not needed to reach the affected code path.

Cisco lists these as not affected: Cloud-delivered Firewall, cdFMC, Secure Access and Secure FMC software.

Fixed releases

ASA release train	First fixed release
9.16 and earlier	9.16.4.104
9.18	9.18.4.96
9.20	9.20.4.50
9.22	9.22.3.200
9.23	9.23.1.48
9.24	9.24.1.27 or 9.24.10.1

FTD release train	First fixed release
7.0 and earlier	7.0.11
7.2	7.2.13
7.4	7.4.9
7.6	7.6.7
7.7	7.7.14
10.0	10.0.3
10.1	10.1.1

Use Cisco's Software Checker with your exact release number, because the right target depends on your hardware and train.

What to do today

Find every ASA and FTD device, including the ones a former IT vendor installed.
Check whether SSL VPN is enabled and whether any tunnel group, including DefaultWEBVPNGroup, uses secondary authentication.
Schedule the upgrade to a fixed release. Plan a maintenance window, since the device restarts.
If you cannot upgrade yet, apply Cisco's mitigation: remove secondary authentication on the affected tunnel groups. Cisco warns this lowers remote access security, so move to the patch quickly and restore the setting afterwards.
Decide what happens to staff if the VPN is down: a second connection path, or a written fallback for the office.
Watch for unexplained firewall reloads in your logs. Cisco has published no indicators of compromise.

Why smaller businesses should care

Edge devices are patched less often than laptops and websites, because nobody wants to restart the firewall. The pattern is familiar: a bug in an internet-facing service gets exploited before many owners have heard about it. BleepingComputer, citing Shadowserver, reports more than 51,000 Cisco ASA SSL VPN devices exposed online, though that count does not say how many are already patched.

Servers behind the firewall need the same discipline. Our notes on the Linux kernel flaw CVE-2026-46300 and the PHP2Shell vulnerabilities cover two more patches worth checking this week, and our website maintenance guide shows how to make updates routine instead of urgent.