Cisco disclosed CVE-2026-76418 on 28 October 2026: a high-severity (CVSS 8.6) flaw in the remote access SSL VPN service of Secure Firewall ASA and FTD software. Cisco says it is aware of exploitation in the wild. An unauthenticated attacker can send a crafted request that makes the device reload. On current information it is a denial-of-service issue, not data theft or takeover, but repeated reloads can keep VPN and, on shared edge devices, the whole site offline.

The useful part for admins: exposure depends on configuration, so you can triage quickly.

Step 1: Decide if a device is in scope

A device is exposed only when all three are true:

  • It runs a vulnerable ASA or FTD release
  • Remote access SSL VPN (webvpn) is enabled on at least one interface
  • Secondary authentication is configured on a tunnel group, including DefaultWEBVPNGroup

Watch for the edge case: turning off the tunnel group list does not remove the risk if DefaultWEBVPNGroup itself uses secondary authentication. On FTD, check the remote access VPN policy in Secure Firewall Management Center or Device Manager.

Step 2: Patch or apply the workaround

  • Take a configuration backup first
  • Move each exposed device to the first fixed release for its train. Examples reported from the advisory: ASA 9.18.4.96, 9.20.4.50, 9.22.3.200; FTD 7.2.13, 7.4.9, 7.6.7
  • Confirm the exact release for your model in Cisco's advisory or the Cisco Software Checker before upgrading
  • If you need time, Cisco's workaround (disable secondary authentication on affected tunnel groups, or turn off the tunnel group list where the default group does not use it) is temporary and may change how users sign in, so warn them

Step 3: Look for signs it already happened

  • Check device uptime and logs for unexpected reloads since October 2026
  • Forward firewall logs to your monitoring or SOC tooling so repeat reloads raise an alert
  • Record times and evidence. In India, the CERT-In Directions of April 2022 require some incidents to be reported within 6 hours, so check with your security or legal adviser

More detail, including the full fixed version table: Cisco ASA and FTD VPN zero-day guide for Indian IT teams

Written by the team at Affix Center, an IT services company in Lower Parel, Mumbai.