Exploitation reportedSat, 31 Oct 2026
Cisco SSL VPN flaw exploited: patch ASA and FTD and verify failover
An unauthenticated attacker can trigger a device reload under a specific secondary-authentication configuration, interrupting remote access.
Article
Cisco disclosed CVE-2026-76418 on October 28, 2026 and rated it 8.6 under CVSS v3.1. Cisco PSIRT observed exploitation in October. The vulnerable path requires Remote Access SSL VPN with secondary authentication configured on a tunnel group.
First fixed ASA releases listed by the Canadian Centre for Cyber Security are 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.4, 9.24.1.27 and 9.24.10.1. The FTD equivalents by branch are 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. Cisco lists no workaround that resolves the flaw.
- 01
Reach SSL VPN
An attacker connects to an affected appliance without signing in.
- 02
Trigger the vulnerable configuration
The VPN tunnel group uses secondary authentication.
- 03
Interrupt remote access
The appliance can reload, affecting VPN users and dependent services.
What to do: from the perimeter to internal systems
- 01
Inventory affected systems
Check production, standby and outsourced ASA/FTD appliances and tunnel-group settings.
See what to doResources: 1
TWISA member solutions
Inventory affected systems
Check production, standby and outsourced ASA/FTD appliances and tunnel-group settings.
- 02
Patch the branch in use
Confirm hardware compatibility and the correct release in Cisco’s advisory.
- 03
Prepare alternate access
Test failover and approved alternative access paths before maintenance.
See what to doResources: 1
TWISA member solutions
Prepare alternate access
Test failover and approved alternative access paths before maintenance.
- 04
Monitor and confirm recovery
Investigate unexpected reloads and confirm VPN, identity and downstream service availability.
See what to doResources: 1
TWISA member solutions
Monitor and confirm recovery
Investigate unexpected reloads and confirm VPN, identity and downstream service availability.
VPN entry points, firewalls, standby systems and identity dependencies
Allow authorized traffic and apply controls at each layer.
- 01
Inventory affected systems
VPN entry points, firewalls, standby systems and identity dependencies
Validate the controlCheck production, standby and outsourced ASA/FTD appliances and tunnel-group settings.
- 02
Patch the branch in use
VPN entry points, firewalls, standby systems and identity dependencies
Validate the controlConfirm hardware compatibility and the correct release in Cisco’s advisory.
- 03
Prepare alternate access
VPN entry points, firewalls, standby systems and identity dependencies
Validate the controlTest failover and approved alternative access paths before maintenance.
Feed logs and traffic data from each layer into monitoring and response.
- Monitor and confirm recoveryInvestigate unexpected reloads and confirm VPN, identity and downstream service availability.
Test and verify
Use authorized asset discovery, vulnerability scanning, penetration and API testing, and attack simulation. Retest after changes and verify monitoring against actual system behavior. Test the VPN and internal access independently of website WAF controls.
TWISA member solutions
Inventory affected systems
Check production, standby and outsourced ASA/FTD appliances and tunnel-group settings.
Prepare alternate access
Test failover and approved alternative access paths before maintenance.
Monitor and confirm recovery
Investigate unexpected reloads and confirm VPN, identity and downstream service availability.
Sources and further reading
- Cisco ASA and FTD advisory
- Canadian Centre for Cyber Security advisory
- Read the full article in Traditional Chinese
Alert updated: 2026/10/31. Check the vendor’s latest guidance for product support and patch status.