Cisco Patches Actively Exploited CVE-2026-76418 in Secure Firewall SSL VPN

Summary

Cisco says CVE-2026-76418 is actively exploited. A crafted unauthenticated request can reload affected ASA or FTD firewalls when SSL remote access and secondary authentication are configured. Cisco released fixes; no RCE or data theft is confirmed.

Key points

Cisco reports exploitation of CVE-2026-76418 began before its October 28, 2026 disclosure; no threat actors or victims have been identified.
The flaw affects vulnerable Cisco Secure Firewall ASA and FTD releases when SSL remote-access VPN is reachable and secondary authentication is configured on an affected tunnel group.
A specially crafted request can trigger an unexpected firewall reload without successful VPN authentication, causing denial of service and interrupting remote access.
Cisco rates the vulnerability CVSS 3.1 8.6. The disclosed impact is availability; remote code execution and data theft have not been confirmed.
Cisco released fixed ASA and FTD software. Administrators should identify affected configurations, upgrade to the appropriate fixed release, and review logs for unexplained reloads.
Temporary configuration mitigations are available, but removing secondary authentication can reduce VPN security; Cisco recommends upgrading.

Article Details

Vulnerability Types: Logic error involving an unchecked return value leading to a NULL pointer dereference
Severity: High (CVSS 3.1: 8.6)
Exploitation Status: active
Exploit Availability: none_reported
Patch Status: available
Workarounds: If DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel-group list with `no tunnel-group-list enable`.
If DefaultWEBVPNGroup uses secondary authentication, remove it with `no secondary-authentication-server-group`; Cisco warns this reduces remote-access VPN authentication security.