--- title: "CVE-2026-76418: Cisco ASA/FTD SSL VPN DoS Under Active Exploitation" description: Cisco's Oct 28, 2026 advisory for CVE-2026-76418 details an actively exploited ASA/FTD SSL VPN DoS flaw. See affected versions, fixes, and mitigations. image: https://blog.openvpn.net/hubfs/blog-images/cve-2026-76418-cisco-asa-ftd-vpn-dos-header-2500.png --- - [Blog](https://blog.openvpn.net) - [Cybersecurity](https://blog.openvpn.net/tag/cybersecurity) # CVE-2026-76418: Cisco ASA/FTD SSL VPN DoS Under Active Exploitation Oct 29, 2026 • 5 min read ![A remote worker's laptop whose link to a rebooting VPN gateway fades out before reaching it, while a second link reaches a healthy standby gateway](https://blog.openvpn.net/hubfs/blog-images/cve-2026-76418-cisco-asa-ftd-vpn-dos-header-2500.png) Share - - - - By Adam Bullock ## **An actively exploited flaw lets unauthenticated attackers knock Cisco ASA and FTD remote-access VPNs offline, and there is no safe workaround.** On October 28, 2026, Cisco disclosed **CVE-2026-76418**, a High-severity (CVSS **8.6**), remote, unauthenticated denial-of-service flaw in the Remote Access SSL VPN service of Secure Firewall ASA and FTD software — and confirmed it is already being exploited. Here's what it affects, how to mitigate it, and why a vendor-diverse fallback path matters when the VPN concentrator itself becomes the outage. ## What is CVE-2026-76418, the Cisco ASA/FTD VPN DoS flaw? Per Cisco's advisory ([cisco-sa-asaftd-tunnel-dos-s6mgkb75](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75), first published October 28, 2026, 19:15 GMT), CVE-2026-76418 is a logic error in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The flaw occurs when secondary authentication is configured on a tunnel group: an unauthenticated, remote attacker can send a crafted request while connecting to the SSL VPN and force the device to reload, causing a denial-of-service condition. Cisco rates it CVSS 3.1 base score 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), tracked under CWE-690. [NVD's entry for CVE-2026-76418](https://nvd.nist.gov/vuln/detail/cve-2026-76418) independently confirms the same CVE ID, CVSS vector, and affected-product list, citing the Cisco advisory as its source. ## Who is affected by this Cisco ASA vulnerability, and is it being exploited? A device is vulnerable if all of the following are true: - It runs an affected ASA or FTD release (see the table below). - The SSL remote-access VPN login service is reachable. - Secondary authentication is configured on a tunnel group — including the default group, DefaultWEBVPNGroup, even if the tunnel group list is disabled. Cisco states: *"In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability."* Cisco has confirmed that Cloud-delivered Firewall (CDFW), Cloud-delivered Firewall Management Center (cdFMC), Secure Access (CSA), and Secure FMC Software are not affected. Publicly documented impact is limited to the DoS/reload condition described above; Cisco has not described the flaw as enabling code execution or data theft. ## Affected and fixed versions | Software | Affected release | First fixed release | | --- | --- | --- | | ASA | 9.16 and earlier | 9.16.4.104 | | ASA | 9.18 | 9.18.4.96 | | ASA | 9.20 | 9.20.4.50 | | ASA | 9.22 | 9.22.3.200 | | ASA | 9.23 | 9.23.1.48 | | ASA | 9.24 | 9.24.1.27 / 9.24.10.1 | | FTD | 7.0 and earlier | 7.0.11 | | FTD | 7.2 | 7.2.13 | | FTD | 7.4 | 7.4.9 | | FTD | 7.6 | 7.6.7 | | FTD | 7.7 | 7.7.14 | | FTD | 10.0 | 10.0.3 | | FTD | 10.1 | 10.1.1 | ## Mitigation: why there's no full workaround for this Cisco ASA VPN vulnerability Cisco is explicit: *"There are no workarounds that address this vulnerability."* The only mitigations are to disable secondary authentication on the affected tunnel group, or to disable the tunnel group list entirely — and Cisco notes both options lower your remote-access VPN's security posture. The advisory recommends upgrading to a fixed release as the real remediation. Given the lack of a safe interim workaround, admins running exposed SSL remote-access VPN with secondary authentication should prioritize patching immediately. ## Reducing single-vendor exposure for remote access VPN An unauthenticated DoS against a VPN concentrator's SSL tunnel service is a reminder that remote-access infrastructure concentrated on one vendor's code is also a concentrated outage risk. Organizations don't need to replace ASA/FTD to add resilience — many are standing up a second, vendor-diverse [secure remote access](https://openvpn.net/use-cases/secure-remote-access/) path that doesn't share Cisco's codebase, so a flaw in one doesn't take down both. - **A standby path for disaster recovery.** OpenVPN Access Server can run as a [self-hosted standby remote access VPN](https://openvpn.net/access-server/) layer, giving admins a tested fallback while an affected ASA/FTD fleet is patched. Pair it with [VPN server clustering for high availability](https://openvpn.net/access-server/features/server-clustering-feature/) so the standby isn't a single point of failure either. - **A broader architecture shift.** For teams moving away from appliance-centric access, CloudConnexa offers [cloud-delivered ZTNA](https://openvpn.net/cloud-vpn/) that decouples remote access from any single on-prem appliance, with [zero trust network access](https://openvpn.net/use-cases/zero-trust-network-access/) applied per application. This isn't a call to abandon Cisco — it's about not having all your remote-access eggs in one vendor's basket. ## FAQ ### What is CVE-2026-76418? It's a High-severity (CVSS 8.6), unauthenticated, remote denial-of-service vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD Software, caused by logic errors when secondary authentication is configured on a tunnel group, per Cisco's October 28, 2026 advisory. ### Is CVE-2026-76418 being actively exploited? Yes. Cisco states that in October 2026 its PSIRT became aware of active exploitation of this vulnerability. ### Is there a workaround for the Cisco ASA VPN DoS flaw? No full workaround exists. The only mitigations — disabling secondary authentication or disabling the tunnel group list — reduce the VPN's security posture, per Cisco. Upgrading to a fixed release is the recommended remediation. ### Which Cisco products are confirmed not affected? Cisco confirmed Cloud-delivered Firewall (CDFW), Cloud-delivered Firewall Management Center (cdFMC), Secure Access (CSA), and Secure FMC Software are not vulnerable. ### What versions fix CVE-2026-76418? Fixed releases span ASA 9.16.4.104 through 9.24.10.1, and FTD 7.0.11 through 10.1.1, depending on your current branch — see the versions table above or Cisco's advisory for your specific release. ### Need a remote-access path that doesn't share a single vendor's code? Try the self-hosted Access Server solution or managed CloudConnexa service for free — no credit card required. [See Which One is Right for You](https://openvpn.net/product-comparison/) ![Adam Bullock](https://blog.openvpn.net/hs-fs/hubfs/adamheadshot.jpg?width=300&height=300&name=adamheadshot.jpg) [Adam Bullock](https://blog.openvpn.net/author/adam-bullock) Adam has loved tech since the days of the dial-up modem. Read his perspective on the OpenVPN blog. ## Related posts from OpenVPN ### Subscribe for Blog Updates ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Adam Bullock", "url" : "https://blog.openvpn.net/author/adam-bullock" }, "dateModified" : "2026-10-29T22:28:50.956Z", "datePublished" : "2026-10-29T22:28:50.000Z", "headline" : "CVE-2026-76418: Cisco ASA/FTD SSL VPN DoS Under Active Exploitation", "image" : [ "https://blog.openvpn.net/hubfs/blog-images/cve-2026-76418-cisco-asa-ftd-vpn-dos-header-2500.png" ], "mainEntityOfPage" : { "@id" : "https://blog.openvpn.net/cve-2026-76418-cisco-asa-ftd-vpn-dos", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.openvpn.net/hubfs/Dark=True%20Medium.png" }, "name" : "OpenVPN" } } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "It's a High-severity (CVSS 8.6), unauthenticated, remote denial-of-service vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD Software, caused by logic errors when secondary authentication is configured on a tunnel group, per Cisco's October 28, 2026 advisory." }, "name" : "What is CVE-2026-76418?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. Cisco states that in October 2026 its PSIRT became aware of active exploitation of this vulnerability." }, "name" : "Is CVE-2026-76418 being actively exploited?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No full workaround exists. The only mitigations, disabling secondary authentication or disabling the tunnel group list, reduce the VPN's security posture, per Cisco. Upgrading to a fixed release is the recommended remediation." }, "name" : "Is there a workaround for the Cisco ASA VPN DoS flaw?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Cisco confirmed Cloud-delivered Firewall (CDFW), Cloud-delivered Firewall Management Center (cdFMC), Secure Access (CSA), and Secure FMC Software are not vulnerable." }, "name" : "Which Cisco products are confirmed not affected?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Fixed releases span ASA 9.16.4.104 through 9.24.10.1, and FTD 7.0.11 through 10.1.1, depending on your current branch. See Cisco's advisory for your specific release." }, "name" : "What versions fix CVE-2026-76418?" } ] } ```