High 8.6Being exploited
Cisco · Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) · CVE-2026-76418
Cisco ASA and FTD firewalls can be crashed remotely through the SSL VPN, attacks under way
A logic error in the Remote Access SSL VPN service lets an unauthenticated attacker make a Cisco firewall reload, cutting off VPN and any traffic it handles. Cisco's security team reports active exploitation and rates it CVSS 8.6. CISA added it to its Known Exploited Vulnerabilities list on 29 October.
- Affected
- ASA and FTD with SSL VPN enabled on an interface and secondary authentication set on a tunnel group, including DefaultWEBVPNGroup. ASA 9.16 and earlier through 9.24, and FTD 7.0 and earlier through 7.7, 10.0 and 10.1. Secure Firewall Management Center is not affected.
- What to do
- Upgrade to the first fixed release: ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 or 9.24.10.1; FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 or 10.1.1. Cisco lists no workaround, but as a mitigation you can disable secondary authentication on the tunnel group list and on DefaultWEBVPNGroup.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
- Why it’s here
- Confirmed exploited, on CISA's KEV list, and Cisco firewalls sit at the edge of many business networks.