---
id: "CVE-2026-76418"
kind: "vulnerability"
aliases: ["CVE-2026-76418"]
title: "Cisco ASA and FTD: crafted SSL VPN request forces device reload"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["asa", "cisco", "firewall", "ftd", "infrastructure", "remote-access", "ssl-vpn"]
not_affected_if: ["no-secondary-auth", "no-ssl-vpn"]
published_at: "2026-10-28T20:18:47+00:00"
first_seen_at: "2026-10-28T20:35:10+00:00"
updated_at: "2026-10-28T20:36:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76418", "first_seen_at": "2026-10-28T20:35:10+00:00"}]
---

# Cisco ASA and FTD: crafted SSL VPN request forces device reload

A logic error in the Remote Access SSL VPN service of Cisco ASA and FTD software, triggered when secondary authentication is set on a tunnel group, lets an unauthenticated remote attacker send a crafted connection request. The attacker can make the device reload unexpectedly, causing a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether SSL remote access VPN is enabled on the ASA or FTD device.
- Check whether any tunnel group has secondary authentication configured, for example with `show running-config tunnel-group`.
- Check the running software version against the fixed releases listed in the Cisco advisory with `show version`.

## Fix

- Upgrade ASA or FTD to a fixed release listed in the Cisco security advisory for CVE-2026-76418; the exact version is unknown from these sources.
- Remove secondary authentication from affected tunnel groups if the business can accept that until the upgrade is done; this is unknown from these sources and should be confirmed with Cisco guidance.

## Timeline

- 2026-10-28T20:35:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76418

## From the sources

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_