CVE-2026-76418CVSS 8.6SSL VPN secondary-authentication denial of service
An unauthenticated SSL VPN request can trigger an unexpected device reload. Successful login is unnecessary; the reported impact is denial of service, not code execution.
Cisco confirms exploitation of an ASA/FTD SSL VPN reload flaw
CVE-2026-76418 lets an unauthenticated attacker force ASA/FTD reloads through SSL VPN when the relevant tunnel group uses secondary authentication. Cisco confirms active exploitation and publishes fixed releases.
- Disclosed
- Oct 28, 2026
- Public disclosure date
- Severity
- CVSS 8.6
- 1 CVE tracked here
- Splash zone
- Vulnerable ASA/FTD with reachable SSL remote access VPN and secondary authentication in the relevant tunnel group
- cisco
- In the wild
- Yes
- Cisco PSIRT reports active exploitation in October 2026.
What happened
Cisco’s exploitation confirmation warrants L4. The authentication setting is a prerequisite, not a requirement for attacker credentials. No victim count or attacker IoCs are supplied. The vendor labels the configuration changes temporary mitigations despite the advisory’s “no workarounds” banner. Hiding the group list is insufficient when the default group itself uses secondary authentication.
What’s in the bowl
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Cisco ASA 9.16 and earlier | 9.16.4.104 | Patched |
| Cisco ASA 9.18 | 9.18.4.96 | Patched |
| Cisco ASA 9.20 | 9.20.4.50 | Patched |
| Cisco ASA 9.22 | 9.22.3.200 | Patched |
| Cisco ASA 9.23 | 9.23.1.48 | Patched |
| Cisco ASA 9.24 | 9.24.1.27 | Patched |
| Cisco ASA 9.24, additional listed target | 9.24.10.1 | Patched |
| Cisco FTD 7.0 and earlier | 7.0.11 | Patched |
| Cisco FTD 7.2 | 7.2.13 | Patched |
| Cisco FTD 7.4 | 7.4.9 | Patched |
| Cisco FTD 7.6 | 7.6.7 | Patched |
| Cisco FTD 7.7 | 7.7.14 | Patched |
| Cisco FTD 10.0 | 10.0.3 | Patched |
| Cisco FTD 10.1 | 10.1.1 | Patched |
Crime-scene timeline
Oct 28, 19:15 UTC
Cisco publishes fixes and confirms exploitation
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Cisco PSIRT advisoryPrimaryExploitation confirmed; affected configuration, release matrix and conditional mitigations.
- Cisco CNA recordPrimaryCVSS 3.1 score 8.6, unauthenticated reload impact and exploitation statement.
- Cisco CSAF release dataPrimaryMachine-readable copy of the advisory and fixed-release matrix.