Cisco Warns of Actively Exploited ASA and FTD VPN DoS Vulnerability, CVE-2026-76418

Cisco has disclosed an actively exploited vulnerability in its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software that could allow an unauthenticated remote attacker to disrupt firewall availability through the Remote Access SSL VPN service.

Tracked as CVE-2026-76418, the vulnerability carries a CVSS 3.1 base score of 8.6, with Cisco classifying the advisory as high severity. The company says it has released software updates to address the issue and recommends upgrading to a fixed release.

The issue is particularly relevant to organisations that rely on remote-access VPN connections to provide employees and administrators with access to corporate networks.

Key Vulnerability Details

Source: Cisco Security Advisory.

How the vulnerability works

According to Cisco, the flaw stems from logic errors in the Remote Access SSL VPN service when secondary authentication is configured for a tunnel group.

An attacker can send a specially crafted request while connecting to the SSL remote-access VPN. Successful exploitation can cause the affected device to reload unexpectedly, resulting in a denial-of-service (DoS) condition.

Cisco's advisory also states that a successful VPN login is not required to reach the affected processing path. This makes it important for administrators to assess the relevant configuration rather than assuming that authentication requirements alone eliminate exposure.

The documented impact is service availability. Cisco's CVSS vector records no direct confidentiality or integrity impact for this vulnerability, while availability is rated high.

Which Cisco products and configurations are affected?

Cisco identifies vulnerable releases of both ASA and FTD software. However, the advisory makes clear that exposure depends on the software release and the device's configuration.

The relevant conditions include:

• A vulnerable release of Cisco Secure Firewall ASA or FTD software.

• An SSL remote-access VPN login service that is reachable.

• Secondary authentication configured in the relevant tunnel-group scope.

Administrators should inspect the configured tunnel groups, including the default tunnel group named DefaultWEBVPNGroup. If the tunnel-group list is enabled, Cisco advises checking all tunnel groups, not only the profiles displayed on the login page. Disabling the list alone does not remove exposure if the default tunnel group still uses secondary authentication.

Cisco has confirmed that the following products are not affected by this specific vulnerability:

• Cloud-delivered Firewall (CDFW)

• Cloud-delivered Firewall Management Center (cdFMC)

• Secure Access (CSA)

• Secure FMC Software

These exclusions apply to the vulnerability described in this advisory and should not be interpreted as a general statement about the security of those products.

Fixed software versions: What administrators should install

Cisco has published fixed releases for the affected ASA and FTD software branches. Administrators should identify their current release and use the appropriate fixed version listed in the advisory.

Source: Cisco's official advisory.

The table lists the first fixed releases documented by Cisco. Administrators should check the full advisory and Cisco Software Checker before upgrading, particularly when selecting a release for a production environment.

No direct workaround, but Cisco documents a temporary mitigation

Cisco states that no workaround addresses the vulnerability. It does, however, describe a mitigation involving the secondary-authentication configuration.

Depending on the configuration, the mitigation may involve disabling the tunnel-group list or removing secondary authentication from the relevant tunnel group.

Cisco warns that these changes can affect VPN functionality and reduce the security posture of remote access. Administrators should therefore evaluate the impact in their own environment before applying a mitigation.

The company recommends upgrading to fixed software rather than relying on configuration changes as a permanent solution.

Recommended actions for security teams

Organisations operating potentially affected Cisco firewalls should prioritise the following steps:

1. Inventory firewall software. Identify ASA and FTD devices and record their current software releases.

2. Check configuration exposure. Verify SSL remote-access VPN reachability and review secondary authentication settings across relevant tunnel groups.

3. Prioritise the upgrade. Compare deployed versions against Cisco's fixed-release table and plan an upgrade to an appropriate supported release.

4. Evaluate temporary mitigations carefully. Assess the potential effect of disabling secondary authentication or changing tunnel-group settings before implementation.

5. Validate after remediation. Confirm the installed release and test the VPN service according to the organisation's change-management procedures.

6. Review security monitoring. Examine relevant firewall and VPN logs for suspicious activity as part of the incident-response process.

These are operational recommendations based on the conditions and remediation guidance in Cisco's advisory. They are not a claim that Cisco has prescribed every step as a mandatory procedure.

What this means for enterprise security

The disclosure highlights the importance of maintaining internet-facing security infrastructure, particularly remote-access services that connect users to corporate environments.

A denial-of-service vulnerability does not necessarily imply data theft or unauthorised access to protected information. In this case, Cisco identifies unexpected device reloads and resulting service disruption as the documented impact.

The report of active exploitation makes timely assessment especially important. Organisations should distinguish between confirming that a vulnerability is being exploited and determining whether their own devices have been targeted. Cisco's advisory confirms active exploitation but does not provide specific information about the number of affected organisations, the scale of attacks, or the identities of attackers.

For enterprises, this reinforces the value of maintaining accurate asset inventories, reviewing security advisories promptly, and applying vendor fixes through a controlled remediation process.

Conclusion

Cisco's advisory for CVE-2026-76418 identifies a high-severity denial-of-service vulnerability affecting certain ASA and FTD software releases under specific remote-access VPN configurations. Cisco reports active exploitation and has released software updates to address the issue.

The immediate priority is to verify exposure and upgrade to the appropriate fixed release. Because Cisco says no workaround fully addresses the vulnerability, temporary configuration changes should not replace software remediation.