Cisco reports attacks on a new firewall VPN flaw that forces reboots
An unauthenticated attacker can knock a Cisco firewall's remote access VPN offline, and the vendor offers no workaround – only fixed software or a mitigation that weakens login security
- Advisory: cisco-sa-asaftd-tunnel-dos-s6mgkb75, published 28 October 2026
- Flaw: CVE-2026-76418, rated 8.6 (high)
- Attacker needs no credentials and no successful VPN login
- Workaround: none; Cisco's mitigation disables secondary authentication
- Earlier exploited flaw in the same service: CVE-2026-20349, disclosed 11 August 2026
Exposed devices run a vulnerable ASA or FTD release with the SSL VPN (WebVPN) login service switched on for at least one interface. Cisco has fixed releases across ASA trains 9.16 to 9.24 and FTD trains 7.0 to 10.1, starting from ASA 9.16.4.104 and FTD 7.0.11. Its cloud-delivered firewall, Secure Access and Secure Firewall Management Center products are not affected. Firewalls without secondary authentication on any tunnel group fall outside this flaw, though not outside the earlier one, which affected any device with SSL VPN or other SSL listening services switched on.
“Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.”Cisco, security advisory, Cisco
Cisco disclosed on 28 October an actively exploited vulnerability in its Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software that lets an attacker with no credentials force the device to reload, cutting every remote access VPN connection running through it. The flaw, CVE-2026-76418, carries a severity score of 8.6 out of 10.
The attack works against firewalls running SSL remote access VPN with secondary authentication – a second login check on top of the first – configured on a tunnel group, the connection profile remote users sign in through. Cisco says a successful VPN login is not needed to reach the faulty code. Its product security incident response team (PSIRT) became aware of exploitation in October. Cisco has not said who is behind the attacks or which organizations were hit, and has published no indicators of compromise, according to BleepingComputer.
It is the second exploited denial-of-service flaw in the same VPN service in less than three months. On 11 August Cisco disclosed CVE-2026-20349, also rated 8.6, which let an unauthenticated attacker crash ASA and FTD devices with a crafted web request. Cisco said at the time that it had seen that flaw exploited in August.
Shadowserver tracks more than 51,000 Cisco ASA SSL VPN devices reachable from the internet, according to Shadowserver figures cited by BleepingComputer. That count does not show how many have been updated.
Cisco lists no workaround. The mitigation it describes is to switch off secondary authentication on the affected tunnel groups, and Cisco's advisory says that with it disabled, “the security posture is lowered for remote access VPN”. Cisco also says customers should evaluate whether a mitigation suits their own environment before using it.
Sources
- Cisco, “Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability”, security advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75, 28 October 2026. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75
- BleepingComputer, “New Cisco firewall zero-day exploited to crash SSL VPN devices”, Sergiu Gatlan, 29 October 2026. https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/
- Cisco, “Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability”, security advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF, 11 August 2026. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF
