If your Cisco ASA or Secure Firewall (FTD) appliance runs an SSL remote-access VPN, you’re one crafted packet away from a knocked-offline network. Attackers are actively exploiting a zero-day denial-of-service flaw — CVE-2026-76418, CVSS 8.6 — that lets an unauthenticated remote attacker crash these firewall devices with a single connection attempt. Cisco’s PSIRT confirmed in-the-wild exploitation in October, and CISA added the bug to its Known Exploited Vulnerabilities (KEV) catalog on October 29 with a federal remediation deadline of November 1. This is not a patch-it-later bucket item. This is a now problem.

What the vulnerability is

CVE-2026-76418 is a denial-of-service bug in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD software. The root cause is a logic error that shows up when secondary (double) authentication is configured on a tunnel group — the same family of sloppy error handling CISA classifies as CWE-690, an unchecked return value leading to a NULL pointer dereference. Send a crafted request while connecting to the SSL VPN login, and the unread return value hands the code a NULL it never checks. The device reloads. Every VPN session drops. Every packet passing through the firewall stops.

The ugly part is who can pull the trigger. No credentials, no prior access, no user interaction. The attack only needs a reachable SSL VPN login. And per Cisco, on FTD you don’t even need a successful VPN authentication — the vulnerable code path runs before a real login completes. One unauthenticated request, device down. Repeated exploitation means recurring outages on the exact front door you pay a firewall to protect.

Who’s exposed

Three conditions stack up to make a device vulnerable:

• It runs a vulnerable ASA or FTD release.
• Its running config contains the webvpn keyword with SSL VPN enabled on at least one interface, so the remote-access login is reachable from the internet.
• Secondary authentication is configured on the applicable tunnel group — including the default DefaultWEBVPNGroup.

That last condition is the trap. Even organizations that hid their tunnel-group list from the login page aren’t off the hook: Cisco notes the default group stays active and must be checked separately. If your firewall is a Cisco ASA or Secure Firewall on a public interface serving remote workers, assume it’s in scope and confirm the version today.

The fix

This is the second ASA/FTD VPN denial-of-service zero-day exploited since August, which makes clear these devices are under steady, coordinated attack. Cisco’s advisory (cisco-sa-asaftd-tunnel-dos-s6mgkb75) lists fixed releases but warns there are no full workarounds — patching is the only complete remedy.

Fixed releases:

• ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 or 9.24.10.1
• FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1

Secure Firewall Management Center, cloud-delivered management, and Secure Access aren’t affected. Verify your exact software train against the advisory before upgrading.

Can’t patch immediately? The interim mitigation is to disable secondary authentication on DefaultWEBVPNGroup and any user-configured tunnel groups in scope. That removes the vulnerable configuration path while you stage the upgrade — but treat it as a stopgap, not a fix, because you’ll be stripping a layer of VPN login security to get there.

What to do right now

• Patch first. Apply the fixed release for your software train immediately. Prioritize any firewall with an internet-facing remote-access VPN.
• Check DefaultWEBVPNGroup. Even if your tunnel-group list is hidden, verify and remediate secondary authentication on the default group.
• Hunt for reloads. Look for unexpected reboots correlated in time with SSL VPN connection attempts, malformed requests in the SSL VPN access log right before a reload, and crash or system-log entries pointing to a NULL dereference in the VPN process. ASA and FTD log message 199005 at startup and 199002 at completion — a restart you didn’t initiate is your red flag.
• Watch for what comes next. A DoS is often the appetizer. Once attackers confirm they can reset your edge, they frequently probe for the next flaw while you’re down. Keep the VPN interface patched, monitored, and logged.

Firewalls crash one request at a time when vendors slip on error handling, and the bad guys know exactly where these front doors sit. CVE-2026-76418 is live in the wild, it’s in CISA KEV, and it takes zero credentials to trigger. Patch your ASA and FTD now.