Cisco Firewall DoS Flaw Exploited in ASA and FTD

A Cisco firewall DoS flaw is being exploited: one crafted request to the SSL VPN login can make a Cisco ASA or Secure FTD firewall reload unexpectedly. Cisco tracks it as CVE-2026-76418 (CVSS 8.6), and CISA added it to the Known Exploited Vulnerabilities catalog on October 29. Only firewalls with secondary authentication set on a tunnel group are exposed, and that includes the default group.

What Happened in the Cisco Firewall DoS Flaw

Cisco published its advisory on October 28. The cause of the Cisco firewall DoS flaw is a logic error in the Remote Access SSL VPN service when secondary authentication is configured on a tunnel group. An unauthenticated attacker sends a crafted request while connecting to the SSL VPN, and the device reloads. For Secure FTD, Cisco adds that a successful VPN login is not required to reach the affected code path. The advisory says Cisco’s PSIRT learned of active exploitation in October 2026. As of October 30, neither the advisory nor the reporting we read names an actor, a start date or the number of devices hit.

A device is affected if it runs a vulnerable release, the SSL VPN login service is reachable, and secondary authentication is set in tunnel group scope. Cisco’s fixed releases are ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 and 9.24.1.27 or 9.24.10.1, and FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. Secure FMC, cloud-delivered Firewall Management Center, cloud-delivered Firewall and Secure Access are not affected. CISA lists the flaw as an unchecked return value leading to a NULL pointer dereference, set a federal deadline of November 1, and marks ransomware use as unknown.

Why It Matters

A VPN gateway that reloads on demand is an availability attack on remote work. Assessment: the reload also takes down everything else the firewall filters until it is back, and a request that can be repeated can keep the device cycling. Nothing in the advisory suggests code execution or data theft, so this is an outage risk rather than a breach, but CISA lists it as exploited and Cisco confirms it.

Assumption: many mid-sized DACH companies add a second authentication server to the VPN login on purpose, as an extra check. If so, the setting meant to harden the login is the one that exposes the firewall. This is the second Cisco edge product with confirmed exploitation this month, after the Secure Email Gateway zero-day we covered on October 19. If you fall under NIS2, an outage that disrupts services may trigger reporting duties, so your incident plan should cover it.

What You Should Do Now

1. Check exposure. On ASA, confirm that webvpn is enabled on an interface, then look at every tunnel group, including DefaultWEBVPNGroup, for secondary-authentication-server-group. Cisco notes that this applies to groups not shown in the login list, too. On FTD, review the remote access VPN policy in Secure FMC or FDM.
2. Upgrade to the fixed release for your branch (see the list above). Cisco strongly recommends upgrading over any mitigation.
3. If you cannot patch yet, Cisco documents a mitigation. If DefaultWEBVPNGroup does not use secondary authentication, enter no tunnel-group-list enable in WebVPN configuration mode; users then need to know their profile name. If it does use secondary authentication, no secondary-authentication-server-group removes it, which Cisco says lowers the security posture of the VPN. Test either change first.
4. Watch for unplanned reloads: check device uptime and crash logs, and correlate any reload with SSL VPN connection attempts from the same sources. We found no published indicators of compromise.

DIESEC Perspective

A firewall reload looks like a hardware fault until someone connects it to a request. Make unplanned restarts of edge devices an alert in your monitoring, and agree in advance who decides whether to switch off the SSL VPN if the reloads repeat.

Edge devices such as VPN gateways are where assumptions about availability and configuration get tested first. Continuous monitoring turns an unplanned reload into an alert instead of a mystery. An external penetration test shows which of your VPN settings are really reachable from the internet. And if you fall under NIS2, who decides to switch a service off, and who reports, should be written down before the outage. More on NIS2.

Not sure whether your ASA or FTD tunnel groups use secondary authentication? Contact DIESEC for a firewall configuration review and patch verification.

Sources: Cisco advisory | CISA | The Hacker News
Published: 2026-11-02 | Category: Vulnerabilities & Patches | ~4 min read