{"id":"CVE-2026-76418","kind":"vulnerability","aliases":["CVE-2026-76418"],"related":[],"title":"Cisco ASA and FTD: crafted SSL VPN request forces device reload","description":"A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.","summary":"A logic error in the Remote Access SSL VPN service of Cisco ASA and FTD software, triggered when secondary authentication is set on a tunnel group, lets an unauthenticated remote attacker send a crafted connection request. The attacker can make the device reload unexpectedly, causing a denial of service.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asa","cisco","firewall","ftd","infrastructure","remote-access","ssl-vpn"],"not_affected_if":["no-secondary-auth","no-ssl-vpn"],"how_to_check":"- Check whether SSL remote access VPN is enabled on the ASA or FTD device.\n- Check whether any tunnel group has secondary authentication configured, for example with `show running-config tunnel-group`.\n- Check the running software version against the fixed releases listed in the Cisco advisory with `show version`.","fix":"- Upgrade ASA or FTD to a fixed release listed in the Cisco security advisory for CVE-2026-76418; the exact version is unknown from these sources.\n- Remove secondary authentication from affected tunnel groups if the business can accept that until the upgrade is done; this is unknown from these sources and should be confirmed with Cisco guidance.","status":"open","published_at":"2026-10-28T20:18:47+00:00","first_seen_at":"2026-10-28T20:35:10+00:00","triaged_at":"2026-10-28T20:36:05+00:00","updated_at":"2026-10-28T20:36:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T20:36:05Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ASA or FTD to a fixed release listed in the Cisco security advisory for CVE-2026-76418; the exact version is unknown from these sources.\n- Remove secondary authentication from affected tunnel groups if the business can accept that until the upgrade is done; this is unknown from these sources and should be confirmed with Cisco guidance.","reach":"internet","title":"Cisco ASA and FTD: crafted SSL VPN request forces device reload","impact":"low","summary":"A logic error in the Remote Access SSL VPN service of Cisco ASA and FTD software, triggered when secondary authentication is set on a tunnel group, lets an unauthenticated remote attacker send a crafted connection request. The attacker can make the device reload unexpectedly, causing a denial of service.","category":"infrastructure","nicknames":[],"who_cares":["cisco","asa","ftd","firewall","ssl-vpn","remote-access"],"confidence":0.6,"needs_auth":"no","worst_case":"Device reloads unexpectedly, causing denial of service for VPN users","analyst_note":"Confirm affected version ranges and fixed releases in the Cisco security advisory for CVE-2026-76418; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-76418 lacks product detail.","how_to_check":"- Check whether SSL remote access VPN is enabled on the ASA or FTD device.\n- Check whether any tunnel group has secondary authentication configured, for example with `show running-config tunnel-group`.\n- Check the running software version against the fixed releases listed in the Cisco advisory with `show version`.","needs_analyst":true,"not_affected_if":["no-ssl-vpn","no-secondary-auth"],"who_is_affected":"Organisations running Cisco ASA or Cisco Secure Firewall Threat Defense with the Remote Access SSL VPN service exposed to untrusted networks. The flaw only applies when secondary authentication is configured on a tunnel group, so devices without SSL remote access VPN or without that setting are likely not affected; the sources do not confirm the exact affected version range.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":3455,"output_tokens":775,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-76418':14A,17A 'access':25B,35B,83C,158C 'adapt':91C 'affect':170C 'allow':105C,164C 'applianc':93C 'asa':2A,18B,41B,94C 'attack':59B,66B,109C,142C,166C 'authent':48B,134C 'caus':73B,111C,168C 'cisco':1A,19B,40B,88C,97C 'condit':124C,178C 'configur':136C 'connect':63B,153C 'could':104C,143C,163C 'craft':5A,62B,150C 'cve':12A,15A 'defens':101C 'denial':75B,120C 'devic':10A,70B,113C,171C 'dos':123C,177C 'due':128C 'error':31B,131C 'exploit':144C,162C 'firewal':20B,90C,99C 'forc':9A 'ftd':4A,21B,43B,102C 'group':54B,140C 'infrastructur':22B 'let':55B 'logic':30B,130C 'make':68B 'reload':11A,71B,115C,173C 'remot':24B,34B,58B,82C,108C,157C 'remote-access':23B 'request':8A,64B,151C 'result':117C,174C 'secondari':47B,133C 'secur':89C,92C,98C 'send':60B,148C 'servic':38B,77B,86C,122C 'set':50B 'softwar':44B,95C,103C 'ssl':6A,27B,36B,84C,156C 'ssl-vpn':26B 'success':161C 'threat':100C 'trigger':45B 'tunnel':53B,139C 'unauthent':57B,107C 'unexpect':72B,116C 'vpn':7A,28B,37B,85C,159C 'vulner':79C,126C,146C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Cisco ASA or Cisco Secure Firewall Threat Defense with the Remote Access SSL VPN service exposed to untrusted networks. The flaw only applies when secondary authentication is configured on a tunnel group, so devices without SSL remote access VPN or without that setting are likely not affected; the sources do not confirm the exact affected version range.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T20:18:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76418","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76418","severity":null,"published_at":"2026-10-28T20:18:47+00:00","modified_at":"2026-10-28T20:18:47+00:00","first_seen_at":"2026-10-28T20:35:10+00:00","fetched_at":"2026-10-28T20:35:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}