Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of…
Affects Cisco ASA and Secure Firewall Threat Defense software with SSL VPN enabled and secondary authentication set in a tunnel group. CVSS rates it 8.6 (high). Cisco has released fixes, with no fixed versions listed in the facts.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: active
- Automatable: yes
- Technical impact: partial
Summary
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software are affected when the Remote Access SSL VPN service is in use. An unauthenticated remote attacker could crash and unexpectedly reload the device, causing a denial of service that interrupts VPN and network availability.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Timeline
- CISA SSVC assessment
Exploitation: active · Automatable: yes · Technical impact: partial
- CVE published
- First seen by cve.now
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Posted on X by cve.now
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
Affected versions
- Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
9.16.1, 9.16.1.28, 9.16.2, 9.16.2.3, 9.16.2.7, 9.16.2.11, 9.16.2.13, 9.16.2.14, 9.16.3.3, 9.16.3, 9.16.3.14, 9.18.1, 9.16.3.15, 9.18.1.3, 9.18.2, 9.16.3.19, 9.16.3.23, 9.18.2.5, 9.16.4, 9.18.2.7, 9.19.1, 9.16.4.9, 9.18.2.8, 9.16.4.14, 9.18.3, 9.19.1.5, 9.16.4.18, 9.19.1.9, 9.18.3.39, 9.16.4.19, and 112 more
- Cisco Cisco Secure Firewall Threat Defense (FTD) Software
7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.2.0, 7.0.2.1, 7.0.3, 7.2.0.1, 7.0.4, 7.2.1, 7.0.5, 7.3.0, 7.2.2, 7.2.3, 7.3.1, 7.2.4, 7.0.6, 7.2.5, 7.2.4.1, 7.3.1.1, 7.4.0, 7.0.6.1, 7.2.5.1, 7.4.1, 7.2.6, 7.0.6.2, 7.4.1.1, 7.2.7, 7.2.5.2, and 37 more
References 1
sec.cloudapps.cisco.com
Questions about CVE-2026-76418
What does this mean?
An unauthenticated remote attacker can cause the device to reload unexpectedly, which results in a denial of service. The flaw is in the SSL remote access VPN login service.Source: sec.cloudapps.cisco.com
Am I affected, and how do I check?
Affected setups are Cisco ASA and Secure Firewall Threat Defense software where SSL VPN is enabled on at least one interface and the running configuration contains the webvpn keyword. Secondary authentication must also be configured in a tunnel group. To check, look for the webvpn keyword in the running configuration and review the tunnel group settings for secondary authentication.Source: sec.cloudapps.cisco.com
What should I do about it?
Cisco has released software updates that address this vulnerability. The facts do not list the fixed version numbers, so check Cisco's advisory for the fixed release for your product line and upgrade to it.Source: sec.cloudapps.cisco.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-29, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
Disable secondary authentication on the user-configured tunnel group list or on DefaultWEBVPNGroup, for example with no tunnel-group-list enable or no secondary-authentication-server-group. This workaround removes the triggering setup until the device can be updated.Source: sec.cloudapps.cisco.com