Cisco patches actively exploited firewall flaw that crashes SSL VPN access

Cisco disclosed on October 28, 2026, that attackers are actively exploiting a flaw in its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. The vulnerability, tracked as CVE-2026-76418 and rated 8.6 out of 10 on the CVSS severity scale, allows an unauthenticated attacker to send a crafted request to the SSL VPN login process and force the device to restart, cutting off remote-access VPN connections and any other traffic the device handles.

This is the second exploited VPN flaw to hit Cisco ASA and FTD products since August. The bug specifically affects devices where secondary authentication is configured on a tunnel group — a common setup for organizations that require a second login step for remote workers. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 29 and set a November 1 compliance deadline for U.S. federal agencies, which reflects how quickly the agency judged this to require attention.

Cisco has released fixed software for all affected ASA and FTD branches. For ASA, patched versions include 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, and 9.24.10.1. For FTD, fixed versions include 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1. As a temporary measure for organizations that cannot upgrade immediately, Cisco suggests disabling secondary authentication on the default tunnel group, DefaultWEBVPNGroup. Devices that do not have SSL VPN enabled on any interface are not exposed.

Organizations running Cisco ASA or FTD with SSL VPN enabled may want to confirm their current software version against Cisco's advisory and prioritize upgrading to a fixed release. IT teams may also want to review whether any secondary authentication tunnel group configuration applies to their deployment.