Cisco says ASA and FTD SSL VPN flaw CVE-2026-76418 was exploited, and lists August's fixed builds as affected

Thirteen of thirteen: the builds that fixed August's zero day are listed as affected

On 28 October 2026 at 19:15 GMT Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418, a flaw in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. It lets an unauthenticated, remote attacker make the device reload, and Cisco says its Product Security Incident Response Team (PSIRT) became aware of active exploitation in October 2026. Set the new advisory's affected list beside the one Cisco published on 11 August for CVE-2026-20349, the earlier exploited SSL VPN reload flaw, and one fact stands out. Cisco named 13 first fixed releases for the August flaw, six for ASA and seven for FTD. All 13 appear as affected versions in the machine readable CSAF file for the October flaw (derived, by matching the two lists).

So a firewall that was patched for August's zero day, on exactly the build Cisco named, is still on a build Cisco lists as vulnerable to October's. That is what any later flaw in the same software would show, and it does not mean the August fix failed: Cisco gives different causes, "insufficient error checking when processing HTTP requests" in August and "logic errors when secondary authentication is configured on a tunnel group" now. What it does mean is that a firewall patched in August and left there has to be patched again. The two advisories are 78 days apart (derived), and the new first fixed release in each train is the next build up: ASA 9.20.4.49 fixed August, 9.20.4.50 fixes October; FTD 7.6.6 fixed August, 7.6.7 fixes October. This briefing was read from 11:18 to about 11:30 GMT on Thursday 29 October 2026, from Cisco's two advisories and the October CSAF file, the CVE records, the NVD record and CISA's Known Exploited Vulnerabilities (KEV) data file. The lead came from SecurityWeek, which calls this the second Cisco firewall VPN zero day since August.

What the record does not establish: Cisco does not say who exploited the flaw, against how many devices, from where, or on what day in October it learned of it. It does not say whether the reloads were the goal or a step towards something else, and it does not say whether the same actor used the August flaw. Cisco publishes no indicators of compromise and no detection signature for this flaw. On interests: Cisco sells these firewalls, wrote the advisory, and as the CVE Numbering Authority also scored its own flaw.

What Cisco says the flaw is, and the three conditions for exposure

Cisco's advisory, version 1.0, Final, rates the flaw High with a CVSS 3.1 base score of 8.6 and tracks it as bug CSCwx26625 and CWE-690. Its summary: the flaw "is due to logic errors when secondary authentication is configured on a tunnel group", and an attacker could exploit it "by sending a crafted request when connecting to the SSL remote access VPN." A successful exploit makes the device reload, which Cisco calls a denial of service (DoS) condition. The advisory adds a line that matters more than the score: "A successful VPN login is not required to reach the affected processing path."

Cisco names three conditions, and a device is affected only when all three hold. It runs a vulnerable ASA or FTD release. The SSL remote access VPN login service is reachable. And secondary authentication is configured in the tunnel group scope the advisory describes. Which tunnel groups count depends on one setting. If tunnel-group-list enable is configured, every tunnel group counts, including the default, DefaultWEBVPNGroup, and Cisco notes the check is not limited to profiles shown on the login page. If the list is absent or removed, the default group still counts, because "disabling the group list does not remove exposure when that default group uses secondary authentication."

Zoom

Cisco lists four products as confirmed not vulnerable: Cloud-delivered Firewall (CDFW), Cloud-delivered Firewall Management Center (cdFMC), Secure Access (CSA) and Secure FMC Software. For FTD, the remote access VPN settings live in Secure Firewall Management Center (Devices, VPN, Remote Access) or Secure Firewall Device Manager, and Cisco tells FTD owners to review the deployed policy and the resulting running configuration.

What a reload means in practice is not set out in the advisory beyond the words denial of service. As an inference, not a Cisco statement: a firewall that reloads stops passing traffic until it is back, so remote users connected through its VPN lose their sessions and must reconnect. How long a reload takes, and whether a high availability pair would carry the traffic, depends on the deployment and is not stated.

Two zero days, 78 days apart, through the same service

The August flaw is CVE-2026-20349, Cisco advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF, first published 11 August 2026 at 16:39 GMT. It too sits in the Remote Access SSL VPN service, it too lets an unauthenticated remote attacker reload the device, and it too scores 8.6 with the identical vector. Its cause is different: "insufficient error checking when processing HTTP requests", recorded as CWE-244. Cisco said its PSIRT became aware of active exploitation in August 2026. CISA's data file shows it was added to the KEV catalogue on 11 August with a due date of 14 August, three days (derived). Cisco first shipped hot fixes; version 1.1 on 16 September replaced them with hardening releases. SecurityWeek's August report covered the hot fixes and the KEV listing.

SecurityWeek is right that CVE-2026-20349 is the August one. The table sets the two advisories side by side, using only what each prints.

Zoom

One date in the record is easy to misread. The CVE record shows CVE-2026-76418 was reserved on 19 August 2026 at 12:02:03 UTC, eight days after the August advisory. But the records for CVE-2026-76466, an Expressway flaw, and CVE-2026-76519, an Email Gateway flaw, were reserved in the same second. That is a batch of IDs Cisco took in advance. It does not show that Cisco knew of the October flaw in August. This site has covered both of those: the Expressway flaw and the Email Gateway flaw.

The fixed release table, and four builds that do not fit it

These are the first fixed releases exactly as Cisco prints them, with the August flaw's column from its advisory version 1.1. In every train the October fix is one build after the August fix, or in ASA 9.22 a later build in the same release. ASA 9.24 has a second fixed line, 9.24.10.1.

The CSAF file Cisco publishes with the advisory lists 1,522 affected pairs of software version and platform. Counted by version, that is 142 ASA versions and 67 FTD versions across 13 platforms (derived). Three things in it are not in the human readable table. First, ASA 9.19 (13 versions) and FTD 7.3 (4 versions) are listed as affected, but the fixed release table has no row for either train. Owners of those trains have no first fixed release named for them in this advisory. Second, four ASA builds listed as affected carry numbers higher than the first fixed release for their train: 9.18.4.135, 9.20.4.235, 9.23.1.195 and 9.24.1.155. Cisco does not explain them. Third, the CSAF platform list names the Secure Firewall 200 Series and 6100 Series, which the advisory's own Software Checker form does not offer.

The practical point for the second item: on these trains, a higher build number does not by itself mean a fixed build. Check each device's exact build against Cisco's Software Checker or the CSAF file rather than by comparing numbers.

Stated and not stated

Each row sets what a source states against what it leaves out. Every cell comes from a saved copy of the page or data file named.

One disagreement is worth watching. Cisco's own text in the CVE record says it became aware of active exploitation. The CISA ADP data in the same record, timestamped 28 October and last updated at 03:57 UTC on 29 October, gives SSVC Exploitation as none, with Automatable yes and Technical Impact partial. For the August flaw, the same CISA field reads active and the KEV listing came the same day. The likely reading is that CISA's assessment had not yet caught up with Cisco's statement, but that is inference; the record does not say.

Three comforting labels that are not controls

Hardening release. On 16 September Cisco told customers to move to hardening releases that carried the August fix as well as "multiple other internally discovered vulnerabilities". Those exact builds are now on the October affected list. The name described what the build fixed at the time; it is not a promise about the next flaw in the same service.

Secondary authentication. A second factor sounds like extra protection, and for logins it is. Here it is the setting that opens the path. Cisco's second mitigation case removes it and says plainly that the security posture of remote access VPN is then lowered. A defender is choosing between two risks until the upgrade.

Hidden group list. Turning off the tunnel group list stops users picking a profile on the login page, and it can look like closing a door. Cisco says it does not remove exposure if DefaultWEBVPNGroup uses secondary authentication, and that the check covers profiles not shown on the login page. What the page shows is not the exposure; the running configuration is.

What to do, in order

Technical details

Each block below is copied from the source named in its caption on 29 October 2026. Cisco publishes no indicators of compromise, log lines or detection rule for CVE-2026-76418, and none is printed here. The October advisory prints configuration keywords and two mitigation commands but no show command. The August advisory says its configuration table shows "the basic configuration for the feature from the show running-config CLI command", so that is the command Cisco itself points to for reading a running configuration.

The vulnerable SSL VPN configuration, as the advisory's table prints it. A device whose running configuration contains this, with SSL VPN enabled on at least one interface, meets the second condition.

webvpn
 enable <interface_name>

The keywords for the third condition. These are the exact names the advisory tells administrators to look for. Whether tunnel-group-list enable is present decides which tunnel groups must be checked.

tunnel-group-list enable
DefaultWEBVPNGroup
secondary-authentication-server-group

The two mitigation commands. Case 1 applies only when DefaultWEBVPNGroup does not use secondary authentication, and is entered in WebVPN configuration mode. Case 2 applies when it does. Cisco says the mitigation was proven in a test environment and that customers must judge its effect in their own.

Case 1 (WebVPN configuration mode):
no tunnel-group-list enable

Case 2:
no secondary-authentication-server-group

The scoring and identifiers in the CVE record, followed by the CISA data in the same record. The vector explains the 8.6: network, low complexity, no privileges, no user interaction, scope changed, availability impact high, nothing for confidentiality or integrity.

dateReserved: 2026-08-19T12:02:03.633Z
datePublished: 2026-10-28T20:05:31.926Z
problemType: CWE-690 Unchecked Return Value to NULL Pointer Dereference
cvssV3_1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H  baseScore 8.6  HIGH
source: advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75, discovery EXTERNAL, defects CSCwx26625
exploits: In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.

SSVC version 2.0.3, role CISA Coordinator, timestamp 2026-10-28T00:00:00+00:00
Exploitation: none
Automatable: yes
Technical Impact: partial

The August flaw's KEV entry, for comparison. It shows how fast CISA moved on the earlier flaw: listed on the day of Cisco's advisory with a three day deadline.

cveID: CVE-2026-20349
vendorProject: Cisco
vulnerabilityName: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
dateAdded: 2026-08-11
dueDate: 2026-08-14
knownRansomwareCampaignUse: Unknown
forensicTriage: No
cwes: CWE-244

Derived by this site from the CSAF file, the affected builds that sit outside the fixed table. Use it to check devices on these builds individually.

Affected trains with no first fixed release row:
  ASA 9.19  13 versions, 9.19.1 to 9.19.1.42
  FTD 7.3    4 versions, 7.3.0 to 7.3.1.2

Affected builds numbered above the first fixed release for their train:
  ASA 9.18.4.135  (first fixed 9.18.4.96)
  ASA 9.20.4.235  (first fixed 9.20.4.50)
  ASA 9.23.1.195  (first fixed 9.23.1.48)
  ASA 9.24.1.155  (first fixed 9.24.1.27)

The question that exposes the gap

Twice in 78 days an unauthenticated request to the same SSL VPN service has been enough to restart a Cisco firewall, and twice Cisco has reported active exploitation in the same month it published the fix, without saying anything about the attacks. Cisco gives defenders no indicator for either flaw. So the question for any team running these devices is plain: if one of your VPN firewalls reloaded on its own in the last three months, did anyone ask why, and do you still have the crash information that would let Cisco tell you?

Key facts