What happened
An attacker on the network can make a Cisco firewall restart without logging in. They do it by sending a specially built request while connecting to the device's SSL remote access VPN. Each restart takes the device offline for a while, cutting off traffic and VPN users.
Two products in Cisco's Secure Firewall line share the weakness: ASA Software and FTD Software. It lives in the code that handles remote access VPN connections over SSL. It is caused by faulty logic on tunnel groups that use secondary authentication. The software fails to check a result before using it, and the device crashes.
Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 on 28 October 2026. The Dutch NCSC followed with advisory NCSC-2026-0463.
Who is affected
The flaw affects Cisco devices running the Remote Access SSL VPN with secondary authentication configured on a tunnel group.
These FTD Software versions are affected: before 7.0.11; 7.2.0 to before 7.2.13; 7.3.0 to before 7.4.9; 7.6.0 through 7.6.7; 7.7.0 to before 7.7.14; 10.0.0 to before 10.0.3; and 10.1.0.
These ASA Software versions are affected: before 9.16.4.104; 9.18 to before 9.18.4.96; 9.19 to before 9.20.4.50; 9.22 to before 9.22.3.200; 9.23 to before 9.23.1.48; 9.24.1 to before 9.24.1.27; and 9.24.10.
How serious is it
Cisco rates the flaw 8.6 out of 10. An attacker needs no account and no help from a user, and the bug can be triggered remotely. It does not expose data or let anyone change settings. The damage is an outage of the firewall and the VPN that depends on it.
The flaw is already being used in attacks. CISA added it to its Known Exploited Vulnerabilities catalog on 29 October 2026.
What you should do
- 1Check whether any tunnel group on your ASA or FTD devices uses secondary authentication for the SSL remote access VPN.
- 2Update affected ASA and FTD devices to a fixed release listed in Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75.
- 3Apply Cisco's mitigations where you cannot update right away.
- 4US federal agencies must act on CISA's required action by 1 November 2026, or stop using the product if no mitigation is available.
Quick facts
| CVE | CVE-2026-76418 |
|---|---|
| CVSS | 8.6 |
| Actively exploited | Yes |
| Patch available | Yes |
| CISA due date | 2026-11-01 |
| Vendor advisory | cisco-sa-asaftd-tunnel-dos-s6mgkb75 |
| Vendor | Cisco |
| CWE | CWE-690 |