[Urgent] Cisco ASA / FTD CVE-2026-76418: Added to CISA KEV on Oct 29 — SSL VPN With Secondary Authentication Can Be Made to Reload by a Crafted Request; Update to 9.20.4.50 or Your Branch's Fixed Release (CVSS v3.1 8.6)

CVE-2026-76418, a flaw in Cisco Secure Firewall ASA / FTD (the software on the firewall appliances at the edge of a company or school network), was added to the KEV catalog of CISA, the US cybersecurity agency, on October 29, 2026. KEV lists vulnerabilities that have actually been exploited. In its October 28 advisory Cisco says it became aware of exploitation in October. A device with secondary authentication on its SSL VPN (the VPN used to connect in from outside) can be made to reload by an unauthenticated, crafted request (a denial of service). Fixed releases are available. Cisco lists no workaround, but gives one mitigation.

Ask your network administrator whether your organization uses it. A device is affected when it runs ASA / FTD, the SSL VPN login is reachable from outside, and a tunnel group (the VPN connection profile) has secondary authentication. Personal computers and phones are not affected.

Where the score comes from: 8.6 (CVSS v3.1) is the rating NVD lists from the party that assigned the CVE (Cisco). The vector is network, low complexity, no privileges, no user interaction, scope changed, high availability impact, so the impact is the device going down, not data leakage or takeover. I did not find a score from NIST itself in NVD. When NIST adds its own score, this number may change.

What is happening (as far as it has been published)

• ▸CVE-2026-76418: According to Cisco, the SSL VPN (remote access VPN) of ASA / FTD has a flaw caused by logic errors when secondary authentication is configured on a tunnel group. An unauthenticated attacker who sends a crafted request while connecting to the SSL VPN can make the device reload unexpectedly, causing a denial of service. A successful login is not required
• ▸Cisco's advisory: Published October 28. It says that "in October 2026, the Cisco PSIRT (product security response team) became aware of active exploitation of this vulnerability." The flaw was found while resolving a Cisco support case
• ▸CISA KEV: Added on October 29, with a due date of November 1 (a deadline for US federal agencies). Use in ransomware campaigns is listed as "Unknown." The KEV entry names no attacker
• ▸Type of weakness: KEV calls it an unchecked return value leading to a NULL pointer dereference (CWE-690)

Affected configuration and the versions to move to

• ▸When a device is affected (Cisco): all three must be true. (1) It runs a vulnerable ASA or FTD release. (2) The SSL VPN login service is reachable. (3) Secondary authentication is configured in a tunnel group. If the configuration contains "webvpn" and SSL VPN is enabled on an interface, (2) is met. Check secondary authentication under "secondary-authentication-server-group" in each tunnel group. If "tunnel-group-list enable" is set, check every tunnel group, including the default one, "DefaultWEBVPNGroup." Even with the list turned off, you are affected if the default tunnel group uses secondary authentication
• ▸ASA first fixed releases: 9.16 and earlier: 9.16.4.104; 9.18: 9.18.4.96; 9.20: 9.20.4.50; 9.22: 9.22.3.200; 9.23: 9.23.1.48; 9.24: 9.24.1.27 or 9.24.10.1
• ▸FTD first fixed releases: 7.0 and earlier: 7.0.11; 7.2: 7.2.13; 7.4: 7.4.9; 7.6: 7.6.7; 7.7: 7.7.14; 10.0: 10.0.3; 10.1: 10.1.1
• ▸Not affected (confirmed by Cisco): Cloud-delivered Firewall (CDFW), Cloud-delivered Firewall Management Center (cdFMC), Secure Access, Secure FMC

What to do today

• ✓★Check the ASA / FTD version. Earlier than the fixed releases above means it may be affected. For FTD, review the deployed remote access VPN policy in the management center (FMC) or the device manager (FDM)
• ✓★Update to a fixed release. Back up the configuration first and pick a window in which an outage is acceptable. Cisco strongly recommends upgrading
• ✓Check the configuration. See whether SSL VPN is enabled and whether any tunnel group uses secondary authentication. If neither applies, this flaw does not affect you, but keep the version current
• ✓Check the logs for unexplained reloads. Exploitation makes the device reload (this is our suggestion, not a step given by Cisco)
• ✓Put VPN devices exposed to the internet first. The KEV listing is the reason for that order

If you cannot update right away

Cisco says there is no workaround for this vulnerability, and gives one mitigation: turn secondary authentication off on any user-configured tunnel groups and on the default tunnel group "DefaultWEBVPNGroup." If the default tunnel group does not use secondary authentication, enter "no tunnel-group-list enable" in WebVPN configuration mode to disable the tunnel group list (users can then no longer pick a connection profile from a list and must know the correct profile name). If the default tunnel group does use secondary authentication, remove it with "no secondary-authentication-server-group." But removing secondary authentication lowers the security of the remote access VPN. Cisco asks you to evaluate the effect on your environment before applying it. This is a stopgap until you update, and the update comes first.

What we could not confirm

• ▸The scale of the attacks or who is behind them. None of the sources I could check gave counts or an attacker
• ▸Damage in Japan. I cannot show that here
• ▸A score from NIST. NVD had only Cisco's rating
• ▸How to obtain the fixed releases and any contract conditions. I did not check this; see Cisco's advisory

If you share this, share these 3 lines

• ▸Cisco ASA / FTD's CVE-2026-76418 was added to CISA's "known exploited" catalog (KEV) on October 29. A device with secondary authentication on its SSL VPN can be made to reload by a crafted request (Cisco learned of exploitation in October)
• ▸★Check the ASA / FTD version and move to your branch's fixed release, such as 9.20.4.50 or FTD 7.4.9. Ask the VPN administrator whether you are affected
• ▸There is no official workaround, only the mitigation of removing secondary authentication. It lowers security, so update first

Pages this article is based on