Cisco has released security updates for a critical vulnerability in its Secure Firewall ASA and FTD products. Attackers are already exploiting the vulnerability. They can remotely crash affected devices, which can disrupt users’ VPN connections.
The vulnerability, registered as CVE-2026-76418, has a CVSS severity score of 8.6. The flaw affects the Remote Access SSL VPN functionality in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD).
According to Cisco, the security vulnerability stems from errors in the handling of secondary authentication. An unauthenticated attacker can exploit the vulnerability by sending a manipulated request to an accessible SSL VPN service. A successful attack forces the firewall to reboot, causing a denial-of-service condition.
The vulnerability affects only specific configurations. Devices are vulnerable when SSL VPN is enabled and secondary authentication is configured for an affected tunnel group. Cisco warns that disabling the tunnel group list does not necessarily eliminate the risk, as the default tunnel group may remain vulnerable.
Security updates available
Cisco has released patches for multiple versions of ASA and FTD software. The updated ASA versions are 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, and 9.24.10.1.
For FTD, the vulnerability has been fixed in versions 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1.
Cisco recommends installing the updates immediately, precisely because exploitation has already been observed in the wild. Administrators can use the company’s Software Checker to determine whether their installations are affected and to identify which updated version is required.
Temporary workaround
Cisco has not provided a complete workaround. However, administrators can temporarily mitigate the risk by disabling secondary authentication on affected tunnel groups, including the default group DefaultWEBVPNGroup.
The company says this measure was successful during testing, but warns that disabling secondary authentication may affect network functionality and security. Organizations should therefore evaluate the implications before implementing the change. Cisco has not disclosed who is behind the attacks.