Cisco ASA and FTD SSL VPN can be remotely rebooted, and CISA put the DoS on KEV

secondary authentication on your AnyConnect tunnel group just became a crash gadget. CVE-2026-76418 lets an unauthenticated remote attacker reload ASA or FTD by sending a crafted SSL VPN request when secondary auth is configured. Cisco PSIRT says it is exploited in the wild. CISA added it to KEV on October 29. due November 1. the sloth checked whether your VPN comes back up after a joke packet.

what the KEV entry and advisory actually say

• CVE-2026-76418, unauthenticated remote DoS via Remote Access SSL VPN. logic errors when secondary authentication is configured on a tunnel group. crafted connect request, device reloads.
• vulnerable when: a vulnerable ASA/FTD release is running, SSL remote access VPN is enabled on at least one interface (webvpn enable <if>), and secondary authentication is configured on a reachable tunnel group (including DefaultWEBVPNGroup even if the group list is hidden).
• not vulnerable: Cloud-delivered Firewall, cdFMC, Secure Access, Secure FMC Software per Cisco.
• known ransomware use: unknown. Cisco has not published IOCs.

a successful VPN login is not required. if the login service is reachable and secondary auth is on the tunnel group, the processing path is live.

how to tell if you are in the blast radius

1. SSL VPN on? running config contains webvpn and enable <interface>. on FTD, check Remote Access VPN in FMC or FDM.
2. secondary auth on a tunnel group? if tunnel-group-list enable is present, check every tunnel group including DefaultWEBVPNGroup for secondary-authentication-server-group. if the group list is disabled, still check DefaultWEBVPNGroup. hiding the list does not remove exposure.
3. version matrix (first fixed): ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 / 9.24.10.1; FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1.

use Cisco’s Software Checker if you do not want to eyeball trains. PSIRT only validates the fixed releases listed in the advisory.

what to do before November 1

1. upgrade to the first fixed release for your train. that is the real fix. Cisco says there are no workarounds that address the vulnerability.
2. temporary mitigation if you cannot patch tonight:
   • if DefaultWEBVPNGroup does not use secondary auth, no tunnel-group-list enable so users cannot pick a secondary-auth profile from the list.
   • if DefaultWEBVPNGroup does use secondary auth, no secondary-authentication-server-group on it. yes, that weakens MFA posture. Cisco says so. treat it as a bridge to the patch, not a lifestyle.
3. watch for unexplained reloads on SSL VPN headends. Cisco did not publish IOCs; a device that reboots when random clients hit the login path is the signal you have.
4. change control the mitigation. document who lost secondary auth, for how long, and the patch ticket that turns it back on after the upgrade.
5. do not confuse this with every other ASA CVE this year. this one is availability, not root. it still takes the VPN offline for every remote worker behind that headend, which is often the same as taking the business offline.

sloth take

DoS bugs get shrugged off until the firewall that terminates every remote session starts rebooting itself. Cisco confirmed exploitation. CISA gave you until November 1. if secondary auth is the only thing between an unauthenticated packet and a reload, either patch or accept that your MFA setting is also your crash toggle. the sloth patches the headend and puts secondary auth back after, not before.

if your edge stack or storefront still has a KEV item open, get a second set of eyes before the federal deadline. Book a slot with Dark Edge Consulting.

sources

• CISA, “CISA Adds Two Known Exploited Vulnerabilities to Catalog” (October 29, 2026) and KEV entry for CVE-2026-76418
• Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 (October 28, 2026)
• BleepingComputer, “New Cisco firewall zero-day exploited to crash SSL VPN devices”