Cisco ASA and FTD VPN DoS: KEV, fixes, mitigation

Facts last checked against the stored sources on 30 Oct 2026

What happened

Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 on 2026 October 28 19:15 GMT, tracking CVE-2026-76418 under bug CSCwx26625. It describes a flaw in the Remote Access SSL VPN service of ASA and Threat Defense (FTD) firewall software that could let an unauthenticated, remote attacker make the device reload unexpectedly, which is a denial of service. Cisco's score is Base 8.6.

Source: Cisco Security Advisory

Quoted text

Advisory ID: cisco-sa-asaftd-tunnel-dos-s6mgkb75 First Published: 2026 October 28 19:15 GMT
Cisco Bug IDs: CSCwx26625 CVE-2026-76418
CVSS Score: Base 8.6
could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
Cisco says the flaw is due to logic errors when secondary authentication is configured on a tunnel group, and that an attacker could exploit it by sending a crafted request when connecting to the SSL remote access VPN.

Source: Cisco Security Advisory

Quoted text

This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN.
Cisco says its Product Security Incident Response Team (PSIRT) became aware of active exploitation of this vulnerability, and strongly recommends upgrading to a fixed software release.

Source: Cisco Security Advisory

Quoted text

the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.
CISA added CVE-2026-76418 to its Known Exploited Vulnerabilities (KEV) catalog on 29 Oct 2026, listing it as Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability. The catalog lists 1 Nov 2026 as the due date.

Source: CISA Known Exploited Vulnerabilities catalog

Quoted text

"cveID": "CVE-2026-76418", "vendorProject": "Cisco", "product": "Secure Firewall ASA Software and Cisco Secure FTD Software", "vulnerabilityName": "Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability", "dateAdded": "2026-10-29",
"dueDate": "2026-11-01",

Who is affected

Cisco says a device is affected when three things are true: it runs a vulnerable release of Cisco Secure Firewall ASA Software or Cisco Secure FTD Software, the SSL remote access VPN login service is reachable, and secondary authentication is configured in the tunnel group scope.

Source: Cisco Security Advisory

Quoted text

This vulnerability affects Cisco devices if they are running a vulnerable release of Cisco Secure Firewall ASA Software or Cisco Secure FTD Software, the SSL remote access VPN login service is reachable, and secondary authentication is configured in the tunnel group scope
For the SSL remote access VPN part, Cisco says the configuration is vulnerable if the running configuration contains the webvpn keyword and SSL VPN is enabled on at least one interface.

Source: Cisco Security Advisory

Quoted text

If the running configuration contains the webvpn keyword and SSL VPN is enabled on at least one interface, the configuration is vulnerable
For the tunnel group part, Cisco says that when tunnel-group-list enable is configured, you should check all tunnel groups, including the default tunnel group DefaultWEBVPNGroup, for secondary-authentication-server-group. The check is not limited to profiles shown in the group list on the login page. If the group list is absent or was removed, check the default tunnel group, because disabling the group list does not remove exposure when that default group uses secondary authentication.

Source: Cisco Security Advisory

Quoted text

If tunnel-group-list enable is configured, check all tunnel groups, including the default tunnel group, DefaultWEBVPNGroup , for secondary-authentication-server-group .
Note: This check is not limited to profiles that are displayed in the group list on the login page.
because disabling the group list does not remove exposure when that default group uses secondary authentication.
On FTD, Cisco says to review the deployed remote access VPN policy and the resulting device running configuration in FMC or FDM. It also says a successful VPN login is not required to reach the affected processing path.

Source: Cisco Security Advisory

Quoted text

Note: On Cisco Secure FTD Software, review the deployed remote access VPN policy and the resulting device running configuration in Cisco Secure FMC Software or Cisco Secure FDM.
A successful VPN login is not required to reach the affected processing path.
Cisco says it has confirmed that the vulnerability does not affect these products:
- Cloud-delivered Firewall (CDFW)
- Cloud-delivered Firewall Management Center (cdFMC)
- Secure Access (CSA)
- Secure FMC Software
Source: Cisco Security Advisory

Quoted text

Cisco has confirmed that this vulnerability does not affect the following Cisco products: Cloud-delivered Firewall (CDFW) Cloud-delivered Firewall Management Center (cdFMC) Secure Access (CSA) Secure FMC Software

Fixed releases

Cisco's advisory has one table for ASA software and one for Threat Defense software. Each row gives a release train and the first release that includes the fix.

Cisco's ASA table lists the first fixed release for each release train. 9.16 and earlier: 9.16.4.104. 9.18: 9.18.4.96. 9.20: 9.20.4.50. 9.22: 9.22.3.200. 9.23: 9.23.1.48. 9.24: the table lists both 9.24.1.27 and 9.24.10.1.

Source: Cisco Security Advisory

Quoted text

Cisco Secure Firewall ASA Software Release First Fixed Release 9.16 and earlier 9.16.4.104 9.18 9.18.4.96 9.20 9.20.4.50 9.22 9.22.3.200 9.23 9.23.1.48 9.24 9.24.1.27 9.24.10.1
Cisco's FTD table lists the first fixed release for each release train. 7.0 and earlier: 7.0.11. 7.2: 7.2.13. 7.4: 7.4.9. 7.6: 7.6.7. 7.7: 7.7.14. 10.0: 10.0.3. 10.1: 10.1.1.

Source: Cisco Security Advisory

Quoted text

Cisco Secure FTD Software Release First Fixed Release 7.0 and earlier 7.0.11 7.2 7.2.13 7.4 7.4.9 7.6 7.6.7 7.7 7.7.14 10.0 10.0.3 10.1 10.1.1

No workaround, but a mitigation

Cisco says no workarounds address this vulnerability. It does describe one mitigation: disable secondary authentication on any user-configured tunnel group list or on the default tunnel group DefaultWEBVPNGroup.

Source: Cisco Security Advisory

Quoted text

There are no workarounds that address this vulnerability. However, there is a mitigation, which is to disable secondary authentication on any user-configured tunnel group list or on the default tunnel group, DefaultWEBVPNGroup .
Case 1, as Cisco describes it: if DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel group list. In WebVPN configuration mode, enter no tunnel-group-list enable. Users then can no longer choose a connection profile from a list and need to know the correct profile to use.

Source: Cisco Security Advisory

Quoted text

Case 1: If DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel group list. In WebVPN configuration mode, enter no tunnel-group-list enable . With the tunnel group list disabled, users will no longer be able to choose a connection profile (the tunnel-group name) from a provided list and instead will need to know the correct profile to use.
Case 2, as Cisco describes it: if DefaultWEBVPNGroup uses secondary authentication, use the no secondary-authentication-server-group CLI command to remove secondary authentication. Cisco notes that with secondary authentication disabled, the security posture is lowered for remote access VPN.

Source: Cisco Security Advisory

Quoted text

Case 2: If DefaultWEBVPNGroup uses secondary authentication, use the no secondary-authentication-server-group CLI command to remove secondary authentication. With secondary authentication disabled, the security posture is lowered for remote access VPN.
Cisco treats workarounds and mitigations as temporary solutions until an upgrade to a fixed release is available. It says customers should not deploy any of them before first evaluating the applicability and impact in their own environment, and it strongly recommends upgrading to the fixed software.

Source: Cisco Security Advisory

Quoted text

Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available.
Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Cisco strongly recommends upgrading to the fixed software listed in the Fixed Software section of this advisory.

How to check your device

Do these on each ASA and FTD device that offers SSL remote access VPN.

Cisco provides the Cisco Software Checker, which identifies the Cisco security advisories that affect a specific software release and the earliest release that fixes them. Enter a release number such as 9.20.3.4 for ASA or 7.4.2 for FTD.

Source: Cisco Security Advisory

Quoted text

This tool identifies any Cisco security advisories that impact a specific software release and the earliest release that fixes the vulnerabilities that are described in each advisory
Enter a release number-for example, 9.20.3.4 for Cisco Secure Firewall ASA Software or 7.4.2 for Cisco Secure FTD Software.

These commands run on your own machine and only read what is installed there: versions, issuers, validity dates and trust-store entries. PatchBell does not scan your systems.

ASA command line

Read the running configuration. First look for the webvpn keyword with SSL VPN enabled on an interface. Then check every tunnel group, including the default tunnel group, for secondary-authentication-server-group. Reading changes nothing.

Tool documentation: Cisco Security Advisory

Quoted text

If the running configuration contains the webvpn keyword and SSL VPN is enabled on at least one interface, the configuration is vulnerable

If tunnel-group-list enable is configured, check all tunnel groups, including the default tunnel group, DefaultWEBVPNGroup , for secondary-authentication-server-group .

FTD, in FMC or FDM

On FTD there is no direct ASA-style command in the advisory. Review the deployed remote access VPN policy and the resulting device running configuration in FMC or FDM for the same two conditions.