Advisory · CVE-2026-76418
Denial of service in Cisco ASA and FTD SSL VPN with secondary authentication
An unauthenticated remote attacker can crash Cisco ASA and FTD devices by sending a crafted request to the SSL remote access VPN when secondary authentication is configured. Rated 8.6.
- Vendor
- Cisco
- Product
- Cisco Secure Firewall ASA and FTD
- Identifier / CWE
- CVE-2026-76418
CWE-690 - Action timing
- Immediate
Explain it like I’m five
The VPN login path mishandles a second login step. A crafted connection request makes the firewall trip and reload, knocking VPN service offline.
- 01Secondary authentication configured
The target tunnel group has secondary authentication configured on the SSL remote access VPN.
- 02Crafted connection request
An unauthenticated remote attacker sends a crafted request when connecting.
- 03Device reload
Logic errors cause the device to reload unexpectedly, resulting in denial of service.
What happened
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service. The flaw is due to logic errors when secondary authentication is configured on a tunnel group. An attacker sends a crafted request when connecting to the SSL remote access VPN, and a successful exploit reloads the affected device. Cisco rates it 8.6.
The impact is availability only: no data access or code execution is described. But a reloadable firewall VPN is still a serious outage vector, especially since the trigger is unauthenticated and remote.
What to do
- Inventory Cisco ASA and FTD devices with SSL remote access VPN and secondary authentication on tunnel groups.
- Apply the fixed release from the Cisco advisory.
- Restrict VPN endpoint exposure where possible until patched.
- Monitor for unexpected device reloads correlated with VPN connection attempts.
- Confirm the deployed version after patching.
Management note
Availability flaws on edge VPN gear deserve edge priority: the attacker needs no credentials and the result is a firewall reboot. Patch the exposed tunnel groups first.