Cisco Secure Firewall ASA and FTD Denial of Service

What happened

Cisco Secure Firewall ASA and Secure Firewall FTD have a vulnerability in their remote access SSL VPN service that can make an affected device restart unexpectedly. Think of a reception desk where an unusual check-in request causes the entire desk to close and reopen, interrupting everyone waiting for service. Here, the disruption affects a network security device instead of a reception desk.

The vulnerability, CVE-2026-76418, involves the way the VPN service handles connections when secondary authentication is configured on a tunnel group. A remote attacker does not need to sign in successfully to trigger the problem. A specially crafted connection request can cause a restart, creating a denial of service: a disruption that prevents the affected service from being available.

CVE-2026-76418 is known to be exploited. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-29, with a listed due date of 2026-11-01. The catalog marks known ransomware use as Unknown, which does not establish whether ransomware is involved. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-10-30.

Technical details

The affected component is the remote access SSL VPN service, which provides an encrypted connection for users accessing a network remotely. The relevant configuration condition is secondary authentication on a tunnel group, a grouping of VPN connection settings. The vulnerability description ties the problem to logic errors in handling that configuration; it does not establish that every installation of an affected release is exploitable regardless of configuration.

The attack requires remote access to the affected VPN service, but it does not require an authenticated account. The attacker sends a crafted request while connecting to the VPN. Successful exploitation causes the device to restart unexpectedly. The documented outcome is a denial of service; the advisory description does not establish data theft or code execution.

NVD classifies the weakness as CWE-690, NULL Pointer Dereference Following Unchecked Return Value. In plain language, that classification describes software using a returned value without checking whether it is valid, then attempting to access something that is absent. The vulnerability description identifies logic errors as the root cause but does not explain the underlying code sequence in greater detail.

NVD published its entry on 2026-10-28 and lists a CVSS 3.1 score of 8.6 with HIGH severity. CVSS, the Common Vulnerability Scoring System, summarizes technical severity. It is not a prediction of whether a particular device will be attacked. For prioritization, the separate CISA KEV listing adds evidence that exploitation is already occurring.

Weakness types: Denial of service

Who is affected

Everyday users

If you connect to work through an affected Cisco VPN, an unexpected device restart could interrupt your connection and access to resources reached through it. A dropped VPN session by itself does not prove this vulnerability was exploited, but service interruptions are the practical concern described by this advisory.

The software fix belongs on the affected Cisco device. If your organization manages that device, its IT team needs to check the software release and relevant VPN configuration. The documented vulnerability concerns service availability; it does not establish that an everyday user's files or credentials have been stolen.

Developers

Developers who rely on the affected VPN to reach development systems may experience interrupted access when the device restarts. The corrective action is an update to Secure Firewall ASA or Secure Firewall FTD, following Cisco's advisory.

For junior developers, the weakness classification illustrates why checking return values matters: software must handle missing or invalid results before using them. For this specific issue, however, the available description does not support reconstructing the vulnerable code or assuming that a change to an application using the VPN would fix the device.

Server and IT admins

Server and IT administrators should check the installed software release and whether the remote access SSL VPN configuration uses secondary authentication on a tunnel group. Those details connect the release inventory to the configuration condition described in the advisory. Because authentication is not required for exploitation, requiring users to sign in does not by itself address this flaw.

Update planning needs to account for the release-specific fixes and the known exploitation status. The ASA release table contains separate entries for 9.24 with different fixed versions. Preserve that distinction and check Cisco's advisory to determine the applicable update path instead of choosing between those entries by assumption.

What to do now

1. Identify devices running Secure Firewall ASA or Secure Firewall FTD. Use the allowed version-check command to record each installed release, then check the vendor advisory for how to assess the relevant remote access SSL VPN and secondary authentication configuration.
2. Prioritize affected devices using the known exploitation status of CVE-2026-76418. CISA KEV lists 2026-11-01 as its due date; use the vendor advisory and your organization's requirements to plan the update.
3. Match Secure Firewall ASA releases to the listed fixes: 9.16 and earlier maps to 9.16.4.104 and later; 9.18 maps to 9.18.4.96 and later; 9.20 maps to 9.20.4.50 and later; 9.22 maps to 9.22.3.200 and later; and 9.23 maps to 9.23.1.48 and later. For 9.24, the table separately lists 9.24.1.27 and later and 9.24.10.1 and later. Check Cisco's advisory to resolve which entry applies to your device.
4. Match Secure Firewall FTD releases to the listed fixes: 7.0 and earlier maps to 7.0.11 and later; 7.2 maps to 7.2.13 and later; 7.4 maps to 7.4.9 and later; 7.6 maps to 7.6.7 and later; 7.7 maps to 7.7.14 and later; 10.0 maps to 10.0.3 and later; and 10.1 maps to 10.1.1 and later.
5. Follow the update steps in the vendor's advisory. Treat each fixed release as part of its corresponding release entry, rather than assuming that an unrelated version with a larger number is the appropriate upgrade target.
6. After the update, confirm the installed release and normal VPN operation. Record the device's resulting version so the team can distinguish completed updates from devices still awaiting remediation.

show version

If you can't update yet

• If an update must wait, check the vendor advisory for guidance on restricting access to the affected VPN service and reducing its internet exposure. These are general exposure-reduction principles, not a confirmed workaround for this vulnerability.

How to confirm the fix

• Run the version-check command after updating and compare the installed release with the applicable fixed-version entry in Cisco's advisory.
• For Secure Firewall ASA 9.24, confirm that the selected fix follows the applicable advisory entry; the table lists separate fixed versions and does not explain their distinction here.
• Confirm that authorized users can connect through the VPN and reach the resources they normally use after the update.
• Keep version verification separate from service checks: a successful VPN connection confirms operation, while matching the applicable fixed release confirms that the documented software fix is installed.

NVD scores and CISA KEV status

Listed in CISA's Known Exploited Vulnerabilities catalog: CVE-2026-76418 (added October 29, 2026). CISA adds a CVE only when it has evidence of exploitation in the real world.

Affected products and fixed versions 14 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• Cisco advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75
• NVD: CVE-2026-76418
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on October 30, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.