Cisco has published fixes for CVE-2026-76418, a flaw in the Remote Access SSL VPN service on Secure Firewall ASA and Secure Firewall Threat Defense. The company rates it 8.6. Someone who can reach the VPN login page can send a crafted request and force the box to reload. A completed login is not required.
When a firewall is actually exposed
Cisco says three conditions have to line up. The device is running a vulnerable ASA or FTD release, the SSL remote-access VPN login is reachable from the attacker, and a tunnel group is set to use secondary authentication. Turning off the tunnel-group list does not clear the problem if the default group, DefaultWEBVPNGroup, still points at a secondary authentication server.
Cisco described the bug as a logic error on that secondary-authentication path. It said it became aware of attacks in October 2026, and it did not name a start date, a group, or a count of devices.
The builds that close it
For ASA, 9.16 and earlier are fixed in 9.16.4.104. The later trains Cisco listed are 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and either 9.24.1.27 or 9.24.10.1. On FTD, the fixed releases it named are 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1.
Until the upgrade is on the device, Cisco's stopgap is to remove secondary authentication from the tunnel groups that use it. If DefaultWEBVPNGroup does not use secondary authentication, disabling the tunnel-group list is the other option it offered. On FTD that setting sits in the remote-access VPN policy pushed from Firewall Management Center or Firewall Device Manager.
Adapted from The Hacker News report dated October 29, which quotes Cisco's advisory. The picture is the graphic from that report. Site publication: 2026-10-30T04:25:00+08:00.
