Cisco ASA and FTD: SSL VPN can be disrupted before login
Cisco reports active exploitation of CVE-2026-76418. SSL VPN and secondary authentication determine exposure, including on the default group. Fixes depend on the release branch.
Going deeper
Generated image · SecuFocus
At a glance
Key points
If Cisco ASA or FTD provides your organization’s VPN, send this advisory to its administrator. An unauthenticated request can reload the appliance when a reachable SSL VPN uses secondary authentication in the tunnel-group scope Cisco describes. This advisory concerns denial of service, not demonstrated data theft.
The default group matters too
The 28 October advisory covers Cisco Secure Firewall ASA and Secure Firewall Threat Defense. Check the combination of a vulnerable release, reachable SSL VPN login service and secondary authentication. A successful VPN login is not needed to reach the affected processing path.
With tunnel-group-list enable configured, Cisco says to check every tunnel group, including DefaultWEBVPNGroup, not only profiles displayed on the login page. With the list disabled, the default group still matters: removing the list does not eliminate exposure if that group uses secondary-authentication-server-group.
Choose the fix for the installed branch
Cisco lists different fixed releases by branch. For example, ASA 9.18 has first fixed release 9.18.4.96; FTD 7.4 has 7.4.9. These are not universal upgrade targets for other branches. The advisory’s complete table and the supported upgrade path should guide the administrator.
The summary says no workaround is available, while the body describes temporary mitigation: disable the group list only if the default group does not use secondary authentication, or remove that authentication from the default group. The latter lowers VPN security. Do not turn it into blanket advice to disable authentication. Cisco strongly recommends patching and asks customers to assess mitigation impact in their own environment.
Confirmed exploitation is not proof your appliance was attacked
Cisco says it became aware of active exploitation in October. CISA added the CVE to KEV on 29 October with a US federal due date of 1 November. That date is not a universal grace period for every administrator. The KEV entry does not request forensic triage for this item; that does not prove any particular appliance is clean.
This alert is not about every app called a VPN or your computer’s default firewall. It helps check a specific business remote-access service. SecuFocus read the advisory and primary records without testing exploitation, a fix or a customer configuration.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.