Cisco ASA vulnerability CVE-2026-76418: your VPN can knock the firewall offline
The Cisco firewall protecting your office may also be the entry point to your remote employees’ VPN. On October 28, 2026, Cisco released a fix for a flaw in that VPN service that attackers are already exploiting. It is tracked as CVE-2026-76418 and affects Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software.
The next day, the U.S. agency CISA added it to its catalog of exploited vulnerabilities and gave U.S. federal agencies until November 1 to patch. A three-day deadline is a clear signal not to wait for the next maintenance window. Here is how to tell in a few minutes whether this Cisco ASA vulnerability can be exploited on your firewall, and what to do.
What the Cisco ASA vulnerability CVE-2026-76418 allows
According to Cisco’s advisory, an unauthenticated, remote attacker can send a crafted request to the remote access SSL VPN service and make the device reload. It is a denial-of-service attack: no data theft is described, but the firewall goes down. Cisco notes that a successful VPN login is not even required to reach the faulty code.
For a small business, the impact is concrete: while the device reboots, remote employees lose their VPN and everything that flows through that firewall is interrupted. An attacker who repeats the request can stretch the outage. Cisco rates the flaw High, with a CVSS score of 8.6.
BleepingComputer reports that the Shadowserver Foundation tracks more than 51,000 Cisco ASA devices with SSL VPN exposed to the internet. And according to SecurityWeek, this is the second zero-day denial-of-service flaw in the ASA and FTD firewall VPN exploited since August.
Is your firewall exposed? Three questions
The flaw does not affect every setup. Cisco describes a specific combination: a vulnerable release, remote access SSL VPN enabled, and secondary authentication configured in a tunnel group. Follow the tree:
🧭 Am I affected by CVE-2026-76418?
Watch for a trap Cisco points out: the check is not limited to the profiles shown in the login page’s group list. And disabling the group list is not enough if the default group, DefaultWEBVPNGroup, itself uses secondary authentication.
Not affected, according to Cisco: Cloud-delivered Firewall, Cloud-delivered Firewall Management Center, Cisco Secure Access and Secure FMC software.
Fixed releases
Cisco strongly recommends upgrading. Find your branch and write down the installed release in the last column:
Until you update: two mitigations, with their limits
There is no full workaround. Cisco describes two temporary measures, to be tested before you apply them:
⏪ Case 1: DefaultWEBVPNGroup does not use secondary authentication
- In WebVPN configuration mode:
no tunnel-group-list enable. - Effect: users no longer pick their profile from a list; they need to know the correct connection profile.
- Plan for: a short note to employees who connect remotely.
⏩ Case 2: DefaultWEBVPNGroup uses secondary authentication
- Remove secondary authentication with
no secondary-authentication-server-group. - Effect: VPN security is lowered, as Cisco clearly states.
- Keep it short-term, with an update date already set.
In both cases, keep a copy of the original configuration so you can restore it after the update.
Why VPN firewalls have become a top target
Internet-facing equipment such as VPNs and firewalls is targeted because anyone can reach it and it is rarely updated as fast as workstations. We saw it with the Palo Alto GlobalProtect flaw, the Ivanti Connect Secure flaw and FortiBleed at Fortinet. Cisco also recently fixed a flaw in its email gateway.
The lesson is the same: keep an inventory of exposed devices, know their release, and have a plan to update them within days, not months.
How NeoTech can help
Our business network support team checks the VPN configuration of your Cisco firewalls and schedules the update outside business hours. Our cybersecurity services keep an inventory of your exposed equipment, and our automated 24/7 monitoring with on-call technician intervention flags a firewall that reboots or a VPN that goes down.
Book your free cyber check
In 30 minutes, we look together at whether your firewall and VPN are exposed to this flaw, and in what order to fix things.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- Cisco — Remote Access SSL VPN Tunnel Denial of Service Vulnerability (cisco-sa-asaftd-tunnel-dos-s6mgkb75), October 28, 2026
- CISA — Known Exploited Vulnerabilities Catalog (CVE-2026-76418)
- BleepingComputer — New Cisco firewall zero-day exploited to crash SSL VPN devices
- SecurityWeek — Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
- CSO Online — New Cisco firewall zero-day being actively exploited
Photo: Brett Sayles, Pexels (Pexels licence).