Cisco has released security updates for CVE-2026-76418, a high-severity vulnerability in the Remote Access SSL VPN service of Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Cisco says attackers are exploiting the flaw in the wild to force vulnerable firewalls to reload, disrupting VPN access and other network services.
The vulnerability carries a CVSS 3.1 score of 8.6, rated high. According to the CVE record, the issue stems from logic errors when secondary authentication is configured on an SSL VPN tunnel group. An unauthenticated remote attacker can send a specially crafted request while connecting to the VPN service; successful exploitation causes the affected device to reload and creates a denial-of-service condition.
The flaw affects ASA software versions before Cisco’s fixed releases, including branches 9.16, 9.18, 9.20, 9.22, 9.23 and 9.24. The first fixed versions include ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 and 9.24.1.27 or 9.24.10.1, depending on the release train. For FTD, fixed releases include 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1, according to Cisco’s security advisory.
Exposure depends on the firewall’s configuration as well as its software version. Organizations should identify ASA and FTD systems running SSL remote-access VPN and using secondary authentication on tunnel groups, then move them to the appropriate fixed release as soon as operationally possible. Because exploitation does not require valid credentials, internet-facing VPN gateways should receive priority.
Cisco has not attributed the activity to a named threat actor and has not published a public proof of concept. The company’s advisory directs customers to upgrade to a corrected release. Security reporting indicates that disabling secondary authentication on the affected tunnel group may reduce exposure for administrators unable to patch immediately, but that measure can change authentication controls and should be treated as a temporary mitigation rather than a replacement for Cisco’s updates.
