Cisco ASA VPN zero-day reboots firewalls; the second exploited since August
Cisco’s 28 October advisory for its ASA and FTD firewalls, CISA’s 3-day listing, CERT-In’s 2 November note and the August flaw before it: what is confirmed as of 2 November.
Attackers are exploiting CVE-2026-76418, a flaw that lets anyone who can reach the SSL VPN login of a Cisco Secure Firewall ASA or FTD device make it reload, without signing in. Cisco published the advisory and fixed releases on 28 October at 19:15 GMT (00:45 on 29 October in India); its first version already said Cisco’s security team had seen “active exploitation” in October.1 CISA added the flaw to its catalogue of exploited vulnerabilities on 29 October with a due date of 1 November.2 CERT-In followed on 2 November.3 It is the second exploited ASA and FTD VPN flaw since 11 August.4
01What Cisco confirmed: a forced reload, on one configuration
Cisco rates the flaw High, CVSS 3.1 base score 8.6. The cause is “logic errors when secondary authentication is configured on a tunnel group”; a crafted request sent while connecting to the SSL remote access VPN reloads the device. The score’s vector puts confidentiality and integrity impact at none and availability at high: the advisory describes an outage, not a break-in.1
A device is exposed only when all three hold, by Cisco’s account:1
- it runs an affected ASA or FTD release with SSL VPN (
webvpn) enabled on at least one interface; - the SSL VPN login service is reachable;
- secondary authentication is set on a tunnel group, including the default
DefaultWEBVPNGroup, whether or not that group appears on the login page. “A successful VPN login is not required” to reach the faulty code.
Cisco lists Cloud-delivered Firewall, its cloud-delivered management center, Secure Access and Secure FMC as not affected. It gives no workaround, names no attacker and gives no count of affected customers.1
02The second time since August
On 11 August Cisco disclosed CVE-2026-20349, also an unauthenticated reload through the remote access VPN, also CVSS 8.6, also exploited in August, also with no workaround. CISA listed it the same day.42 Cisco first shipped hot fixes, then on 16 September pointed customers to “hardening releases” that carry the fix and other internally found flaws.4
Two exploited ASA and FTD VPN flaws in 11 weeks, each with a 3-day federal deadline
Cisco advisories, CISA KEV listings and due dates, and CERT-In notes, 11 August to 2 November 2026
Table view
| Date | Event | Detail |
|---|---|---|
| 11 Aug 2026 | CVE-2026-20349 | Cisco advisory; CISA lists it the same day |
| 14 Aug 2026 | KEV due date | 3 days after listing |
| 17 Aug 2026 | CERT-In CIVN-2026-0411 | rated High |
| 16 Sept 2026 | Cisco updates fixes | hardening releases replace hot fixes |
| 28 Oct 2026 | CVE-2026-76418 | Cisco advisory, exploited |
| 29 Oct 2026 | CISA lists it | KEV |
| 1 Nov 2026 | KEV due date | 3 days after listing |
| 2 Nov 2026 | CERT-In CIVN-2026-0534 | rated High |
Source: Cisco PSIRT advisories; CISA KEV catalogue (feed version 2026.10.30); CERT-In vulnerability notes · as of 2 November 2026 · KEV due dates bind US federal civilian agencies under BOD 26-04; they are not a deadline for anyone else.
03What Cisco says to do
Upgrade to a fixed release. Cisco’s first fixed releases for CVE-2026-76418:1
- ASA: 9.16.4.104 (9.16 and earlier), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1.
- FTD: 7.0.11 (7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1.
Until then Cisco offers a mitigation it calls temporary: if DefaultWEBVPNGroup has no secondary authentication, turn off the tunnel group list (no tunnel-group-list enable), and users must then know their connection profile; if it does, remove it (no secondary-authentication-server-group), which Cisco says lowers the VPN’s security posture.1
Not yet known: who is exploiting the flaw, against whom, and whether the reloads came alone or with other activity.
Sources
- Cisco, Secure Firewall ASA and FTD Remote Access SSL VPN Tunnel Denial of Service Vulnerability (cisco-sa-asaftd-tunnel-dos-s6mgkb75, CVE-2026-76418) — 28 October 2026
- CISA, Known Exploited Vulnerabilities catalogue, JSON feed (CVE-2026-76418 added 29 October; CVE-2026-20349 added 11 August) — 30 October 2026
- CERT-In, Vulnerability Note CIVN-2026-0534: Denial of Service Vulnerability in Cisco product — 2 November 2026
- Cisco, Secure Firewall ASA and FTD Remote Access SSL VPN Denial of Service Vulnerability (cisco-sa-asaftd-vpn-dos-dzv4mQFF, CVE-2026-20349; v1.1 16 September) — 11 August 2026
- CERT-In, Vulnerability Note CIVN-2026-0411: Remote Access SSL VPN Denial-of-Service Vulnerability in Cisco Product — 17 August 2026
- BleepingComputer, New Cisco firewall zero-day exploited to crash SSL VPN devices (Shadowserver figure) — 29 October 2026
- CISA, BOD 26-04: Prioritizing Security Updates Based on Risk — 10 June 2026
- CERT-In, Directions under section 70B(6) of the IT Act, 2000 (direction (ii) and Annexure I: six-hour reporting) — 28 April 2022
Related on TechBag: the firewall guide and SSL VPN or IPsec VPN.
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
