Cisco reports active exploitation of CVE-2026-76418, a flaw that lets an unauthenticated attacker crash certain ASA and FTD firewalls. Its October 28 advisory says a crafted connection request can force a device reload, interrupting service.
Evidence status: vendor-reported exploitation in the wild. Cisco’s security response team became aware of attacks in October. The advisory does not disclose victims, campaign scale or a first exploitation date. It describes denial of service, not demonstrated code execution or data theft through this flaw.
Sergiu Gatlan’s October 29 report supplies the news context. Cisco’s configuration details narrow the exposure beyond simply running a VPN service.
Reachability and secondary authentication determine exposure
The affected products are Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Exposure requires a vulnerable release, a reachable SSL remote-access VPN login service, and secondary authentication in the applicable tunnel-group scope.
A tunnel group is a VPN connection profile. Cisco tells operators to check the deployed configuration, including these distinctions:
- SSL VPN enabled: look for
webvpnwith SSL VPN enabled on an interface. - Tunnel-group list enabled: examine every tunnel group, including DefaultWEBVPNGroup, for
secondary-authentication-server-group. Checking only profiles shown on the login page misses Cisco’s stated scope. - Tunnel-group list disabled: still inspect DefaultWEBVPNGroup. Hiding the profile list does not remove exposure when that default group uses secondary authentication.
For FTD, review the deployed remote-access VPN policy and the resulting device configuration through its management software. The attacker does not need a successful VPN login to reach the affected processing path.
Cisco confirms that Secure Firewall Management Center software, its cloud-delivered counterpart, Cloud-delivered Firewall and Secure Access are unaffected products. Managing an affected FTD device from an unaffected management product does not repair that device.
Match each deployed release to its fixed branch
Cisco lists these first fixed releases for this CVE:
| ASA release family | First fixed release |
|---|---|
| 9.16 and earlier | 9.16.4.104 |
| 9.18 | 9.18.4.96 |
| 9.20 | 9.20.4.50 |
| 9.22 | 9.22.3.200 |
| 9.23 | 9.23.1.48 |
| 9.24 | 9.24.1.27 or 9.24.10.1, as listed by Cisco |
| FTD release family | First fixed release |
|---|---|
| 7.0 and earlier | 7.0.11 |
| 7.2 | 7.2.13 |
| 7.4 | 7.4.9 |
| 7.6 | 7.6.7 |
| 7.7 | 7.7.14 |
| 10.0 | 10.0.3 |
| 10.1 | 10.1.1 |
Use Cisco’s supported upgrade and hardware-compatibility guidance. Its Software Checker also distinguishes a fix for this advisory from a release addressing all applicable advisories. A first-fixed entry is not a recommendation to downgrade a newer supported installation.
Temporary mitigation can weaken authentication
Cisco lists no complete workaround and strongly recommends upgrading. It describes temporary mitigation with an important condition:
- If DefaultWEBVPNGroup does not use secondary authentication, disabling the tunnel-group list is its documented first case. Users lose the provided connection-profile picker.
- If DefaultWEBVPNGroup does use secondary authentication, Cisco’s second case removes that secondary authentication. Cisco explicitly warns that this lowers the VPN’s security posture.
Evaluate those trade-offs against the actual deployed policy before making a change. Do not interpret the advisory as a blanket instruction to disable an authentication factor. Patching preserves a stronger long-term boundary than leaving a temporary authentication reduction in place.
Caveat: Cisco supplies both the exploitation assessment and mitigation tests. Internet-wide counts of visible ASA devices do not identify which devices meet these conditions, remain unpatched or have been attacked.