Cisco warns of exploited SSL VPN flaw in ASA and FTD firewalls

Cisco published a security advisory on October 28 for a high-severity vulnerability, tracked as CVE-2026-76418, affecting the Remote Access SSL VPN service in its Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Cisco's PSIRT says it is aware of active exploitation of the flaw. The issue stems from logic errors that occur when secondary authentication is configured on a tunnel group, and an unauthenticated remote attacker can exploit it by sending a crafted request while connecting to the SSL VPN, causing the affected device to reload and creating a denial-of-service condition.

A device is vulnerable if SSL remote access VPN is enabled and reachable and secondary authentication is configured on a tunnel group, including the default group. Cisco says there are no workarounds that fully address the vulnerability, though disabling secondary authentication on affected tunnel groups mitigates it at the cost of weakening VPN security. Cloud-delivered Firewall, Cloud-delivered Firewall Management Center, Secure Access, and Secure FMC software are confirmed not affected.

Cisco has released fixed software across its ASA and FTD release branches and strongly recommends customers upgrade rather than rely on the workaround. The vulnerability was discovered by Eric Fernald during a Cisco Technical Assistance Center support case.

Why it matters

Active exploitation of an unauthenticated flaw in widely deployed VPN firewalls means unpatched organizations are at immediate risk of outages.

Source: Cisco