al-ice.ai

The Firewall Reloads Before You Log In: Cisco CVE-2026-76418 Hits KEV

AI Vulnerabilities & CVEs by al-ice.ai Editorial

On 28 October 2026 Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418 (Cisco Bug CSCwx26625, CWE-690, CVSS 8.6), a denial-of-service zero-day in the Remote Access SSL VPN service of Secure Firewall ASA and FTD software — and disclosed that its own PSIRT had found it already under active exploitation earlier in October. The next day, CISA added it to the Known Exploited Vulnerabilities catalog with a 1 November remediation deadline — confirmed against the live KEV feed, which pairs it with the GitLab CVE-2026-97229 listing we covered yesterday. We read Cisco’s advisory first-hand in full, BleepingComputer’s 29 October account first-hand, and the live KEV CSV first-hand. The shape of this one is what makes it dangerous: no login required, no workaround available, and the vulnerable condition is a common hardening feature.

A crash behind the login page

The flaw is logic errors in how the SSL VPN service handles a crafted connection request when secondary authentication is configured on a tunnel group. An unauthenticated remote attacker sends one crafted request while connecting, and the affected device reloads unexpectedly — a full DoS of the firewall and its remote-access VPN. A successful VPN login is not required to reach the vulnerable code path; the device falls over before authentication even happens. Cisco’s exposure test is concrete: if the running configuration contains the webvpn keyword with SSL VPN enabled on at least one interface, and any tunnel group — including the default DefaultWEBVPNGroup, and regardless of whether the group list is displayed on the login page — carries secondary-authentication-server-group, the device is exposed. Disabling the group list display does not remove the exposure. That last detail deserves emphasis, because it defeats the intuitive “we hid the login page options” reassurance: the check must cover the default group either way.

There are no workarounds. The only mitigation short of patching is to disable secondary authentication on the user-configured tunnel-group list or on DefaultWEBVPNGroup — i.e., to turn off a defense-in-depth control to save the device, a trade most teams will hate and some compliance regimes will not tolerate for long. The fixed releases, from Cisco’s advisory: ASA trains 9.16 (fixed in 9.16.4.104), 9.18 (9.18.4.96), 9.20 (9.20.4.50), 9.22 (9.22.3.200), 9.23 (9.23.1.48), and 9.24 (9.24.1.27, with 9.24.10.1 also listed); FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1. Cisco confirms Cloud-delivered Firewall, cdFMC, Secure Access (CSA), and Secure FMC are not affected — if you have already moved that edge to cloud-delivered enforcement, this one passes you by.

What Cisco is not saying

Read the disclosure with the skepticism it invites. Cisco says PSIRT became aware of active exploitation “in October 2026” but publishes no indicators of compromise, no targeting detail, and no attribution — BleepingComputer’s reporting confirms all three absences. Defenders get a patch and a mitigation, but no way to determine whether their devices were already crashed deliberately rather than by accident, and crash telemetry on a firewall fleet is exactly the kind of data that blends into background noise. The KEV listing’s “unknown” ransomware-use flag and a three-day federal deadline (29 October to 1 November) tell the rest of the story: patch on the assumption of exposure, not on evidence of it. This also continues a grim drumbeat for Cisco’s VPN edge — it lands the same week as our PAN-OS management-interface KEV coverage, and edge devices that terminate remote access remain the highest-leverage crash-or-compromise targets in the enterprise.

What to do

  • Meet the 1 November KEV deadline: upgrade ASA/FTD to a fixed release in your train now; treat the three-day federal window as everyone’s window given confirmed in-the-wild exploitation.
  • Check exposure the way Cisco specifies: webvpn plus SSL VPN on any interface, then every tunnel group including DefaultWEBVPNGroup for secondary-authentication-server-group — hiding the group list does not help.
  • If you cannot patch immediately, disable secondary authentication on the affected tunnel groups as the interim mitigation — and log the compliance exception, because you are removing an authentication factor to keep the box upright.
  • Review firewall reload history for unexplained restarts in October: with no IoCs published, unexpected reloads on SSL-VPN-reachable devices are the only retrospective signal available.

Our write-up is analysis of Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 (first published 28 October 2026 19:15 GMT, read first-hand in full) for the vulnerability mechanics, CVSS vector, bug ID, exposure conditions, mitigation, fixed releases, and not-affected products; BleepingComputer’s 29 October reporting (read first-hand in full) for the exploitation framing and the absence of IoCs, targeting, and attribution detail; and the live CISA KEV catalog CSV (read first-hand) confirming the 29 October addition with a 1 November due date. The paired GitLab KEV listing is linked, not restated. All verification was read-only: we sent no crafted requests, scanned no devices, and contacted no party.

Sources: