Cisco ASA and FTD vulnerability CVE-2026-76418: exploited SSL VPN flaw, versions to install

The short answer: a flaw in the remote access SSL VPN of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD), tracked as CVE-2026-76418, lets a remote attacker with no credentials make the device reload. It only affects firewalls where secondary authentication is configured on a tunnel group. Cisco fixed it on 28 October 2026 and confirms active exploitation; CISA added it to its catalogue of exploited vulnerabilities and Morocco’s maCERT (DGSSI) issued an alert on 29 October. Install the fixed release for your train, and apply Cisco’s mitigation in the meantime.

In Morocco, ASA and FTD firewalls are still found in businesses that use them for remote work through Cisco Secure Client (formerly AnyConnect). A remotely triggered reload cuts both the VPN and the whole site’s Internet access. Here is what Cisco, CISA and maCERT say, and what to do.

What is affected

According to Cisco security advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75, a firewall is exposed when all three of the following conditions are met:

1. it runs an affected ASA or FTD release;
2. the remote access SSL VPN login service is reachable (the webvpn keyword is present in the configuration and SSL VPN is enabled on at least one interface; for FTD, remote access is defined in FMC or FDM);
3. secondary authentication (secondary-authentication-server-group) is configured on a tunnel group.

Cisco stresses two points. First, if the tunnel group list is enabled, you must check every group, including DefaultWEBVPNGroup, not just those shown on the login page. Second, disabling that list does not remove exposure if the default group uses secondary authentication. Finally, no successful VPN login is required to reach the vulnerable code.

Product	Affected versions	First fixed release
Cisco ASA 9.16 and earlier	earlier than 9.16.4.104	9.16.4.104
Cisco ASA 9.18	earlier than 9.18.4.96	9.18.4.96
Cisco ASA 9.20	earlier than 9.20.4.50	9.20.4.50
Cisco ASA 9.22	earlier than 9.22.3.200	9.22.3.200
Cisco ASA 9.23	earlier than 9.23.1.48	9.23.1.48
Cisco ASA 9.24	earlier than 9.24.1.27	9.24.1.27 or 9.24.10.1
Cisco FTD 7.0 and earlier	earlier than 7.0.11	7.0.11
Cisco FTD 7.2	earlier than 7.2.13	7.2.13
Cisco FTD 7.4	earlier than 7.4.9	7.4.9
Cisco FTD 7.6	earlier than 7.6.7	7.6.7
Cisco FTD 7.7	earlier than 7.7.14	7.7.14
Cisco FTD 10.0	earlier than 10.0.3	10.0.3
Cisco FTD 10.1	earlier than 10.1.1	10.1.1

Source: Cisco advisory published on 28 October 2026 (bug CSCwx26625). Cisco also points to its Cisco Software Checker to confirm whether a specific release is exposed. Not affected, according to Cisco: Cloud-delivered Firewall, cdFMC, Cisco Secure Access and Secure Firewall Management Center.

Severity and exploitation

• Nature of the flaw: logic errors when secondary authentication is configured on a tunnel group (CWE-690). A crafted request sent while connecting to the SSL VPN causes an unexpected reload of the device, hence a denial of service.
• Severity published by Cisco: high, CVSS 3.1 base score 8.6, with no impact on confidentiality or integrity.
• Exploitation confirmed: Cisco says it became aware of active exploitation in October 2026, without detailing the attackers or the scale.
• CISA KEV catalogue: added on 29 October 2026, with a 1 November deadline for US federal agencies, which has already passed.
• maCERT: bulletin 70222910/26 of 29 October 2026, “Vulnérabilité critique affectant Cisco ASA et FTD activement exploitée”, rates both risk and impact as critical and refers to Cisco’s advisory for the updates.

A denial of service may seem less serious than a takeover. But on a perimeter firewall, every reload cuts the entire site, the inter-site links and the remote workers, and the attack can be repeated for as long as the flaw stays open.

Interim measures, if the update has to wait

Cisco states that no workaround fixes the flaw. It describes a temporary mitigation that depends on how the default group is configured:

1. If DefaultWEBVPNGroup does not use secondary authentication: disable the tunnel group list (no tunnel-group-list enable in WebVPN configuration mode).
2. If DefaultWEBVPNGroup uses secondary authentication: remove it from that group (no secondary-authentication-server-group).

Cisco warns that these settings lower the VPN’s security posture: they must remain temporary and be reverted after the update. Before applying them, back up the configuration and warn mobile users, whose login method may change.

Checks to carry out

• Inventory every ASA and FTD, including standby, branch and disaster recovery firewalls, with their exact release and train.
• Identify those exposing the remote access SSL VPN on an Internet-facing interface.
• Review every tunnel group, DefaultWEBVPNGroup included, to see which ones use secondary authentication.
• Check for recent reloads: any unexplained reload since October should be investigated. Cisco’s advisory publishes no indicators of compromise for this flaw.
• Confirm the release after the update on every node, including the passive unit of a high-availability pair.

Our take for businesses in Morocco

Secondary authentication is often added to strengthen the VPN, for example with a second factor. This flaw shows that a security feature can itself open a door: the answer is not to give up strong authentication, but to update quickly and follow vendor bulletins. It is also a reminder that a firewall carrying both the VPN and Internet access is a single point of failure.

To go further, see our business firewall buying guide for Morocco, our guide to business VPN, IPsec and ZTNA, our patch management method, our advice on multi-factor authentication and our first-hour incident response plan. For the organisations concerned, law 05-20 and DGSSI requirements mean maCERT bulletins must be acted on. A recent alert also hit another remote access VPN: the Ivanti Connect Secure vulnerability CVE-2026-111357.

How we can help

We inventory your firewalls and remote access gateways, check their exposure, apply the mitigation where needed and schedule the update outside working hours. If replacing the firewall is on the table, we compare the options with you. We then provide 24/7 monitoring, with critical incidents handled in under 15 minutes. See our approach to business cybersecurity in Morocco, then request your free initial audit: we reply within 24 business hours.

Sources: Cisco security advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75, CISA alert of 29 October 2026, CISA KEV catalogue, maCERT: bulletin 70222910/26, NVD CVE-2026-76418, Cisco Software Checker.