594/69 Friday, October 30, 2026
Cisco has disclosed CVE-2026-76418, a High-severity vulnerability with a CVSS score of 8.6 affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. The flaw affects the Remote Access SSL VPN service and could allow an unauthenticated attacker to send specially crafted requests that cause an affected device to reload, resulting in a temporary Denial of Service (DoS). Cisco PSIRT confirmed that the vulnerability was exploited in the wild in October 2026, although no details have been disclosed regarding the attackers or the scope of the activity.
The vulnerability is caused by an error in system behavior when Secondary Authentication is configured in a Tunnel Group. A device is affected when it is running a vulnerable version of ASA or FTD, has SSL Remote Access VPN enabled, and uses Secondary Authentication in a Tunnel Group. An attacker can send specially crafted requests during an SSL VPN connection to trigger a device reload without successfully authenticating to the VPN. Administrators should review both custom Tunnel Groups and DefaultWEBVPNGroup, as systems may remain affected even when tunnel-group-list is disabled if Secondary Authentication is still enabled in DefaultWEBVPNGroup.
Administrators should update to Cisco-fixed releases, including ASA versions 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, and 9.24.10.1. For FTD, affected systems should be upgraded to versions 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, or 10.1.1, depending on the release branch in use. Cisco stated that there is no workaround that directly addresses the vulnerability. However, organizations can temporarily reduce exposure by disabling Secondary Authentication or modifying Tunnel Group configurations according to Cisco guidance. Because these changes may affect Remote Access VPN authentication workflows, administrators should assess the operational impact before applying them.
Source: https://thehackernews.com/2026/10/cisco-patches-actively-exploited-asa.html