What happened

On October 28, 2026 Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for vulnerability CVE-2026-76418 in the remote access SSL VPN of Cisco Secure Firewall ASA and Secure FTD. An unauthenticated attacker can send a crafted request while connecting to the VPN and make the device reload, taking the VPN (and sometimes the office's whole internet link) offline. Cisco rates it High (CVSS 3.1 of 8.6), and its PSIRT said it became aware of active exploitation during October 2026. BleepingComputer also cites Shadowserver data showing more than 51,000 ASA firewalls with SSL VPN exposed to the internet.

To be precise: according to the advisory the impact is on availability (denial of service). It does not describe code execution or data theft, and Cisco has not published indicators of compromise.

Who is affected and why it matters for a small or mid-sized business

ASA and FTD devices are affected when all of these apply: webvpn is enabled on at least one interface, secondary-authentication-server-group is set in any tunnel group (including DefaultWEBVPNGroup, even if the profile is not shown on the login page), and the VPN login service is reachable. Cisco confirms that Cloud-delivered Firewall, cdFMC, Secure Access and Secure FMC are not affected.

For a small business, the remote access VPN is often the only path for home working, branch offices or access to the ERP and file servers. If the firewall keeps rebooting, the business loses remote access exactly when it needs it. And since no username or password is needed to trigger it, having the VPN published on the internet is exposure enough.

What to do right now

  1. Find out whether you have these devices. Check your inventory for Cisco ASA or Firepower/Secure Firewall (FTD) units, including ones installed by a previous provider that nobody looks at anymore.
  2. Check your exposure. On the ASA, look in the running configuration for webvpn with SSL VPN on an interface and for a tunnel group with secondary-authentication-server-group. To see whether your version is affected, use the Cisco Software Checker linked from the advisory.
  3. Upgrade to a fixed release. Per the advisory, first fixed releases include, for example, ASA 9.18.4.96, 9.20.4.50 and 9.22.3.200, and FTD 7.2.13, 7.4.9 and 7.6.7 (the full table, with the other branches, is in the advisory). Cisco recommends upgrading over any other measure.
  4. If you cannot upgrade today, apply the documented mitigation. If DefaultWEBVPNGroup does not use secondary authentication, Cisco says to run no tunnel-group-list enable; users will then need to know the exact connection profile name. If it does use it, the alternative is no secondary-authentication-server-group, but that lowers VPN security and is a last resort. Cisco states there is no complete workaround.
  5. Plan a change window. Upgrading a firewall means downtime; schedule it outside business hours, with a configuration backup and a rollback plan.
  6. Monitor. Watch for unexpected firewall reloads and spikes of VPN connection attempts in the logs.

How we approach it at EDESSI

When a critical or actively exploited vulnerability appears, our general procedure is always the same: first, inventory which systems and versions each client runs to know whether they are really affected; then prioritize by internet exposure and service criticality; patch in a controlled window, with a configuration backup and a rollback plan; and finally verify the change was applied and document it. In a case like this, the first concrete step is checking whether the device publishes an SSL VPN with secondary authentication, because that defines the real urgency.

How we can help

If you do not know which firewall you have, whether your VPN is published or whether your devices are up to date, we can review your perimeter and set up a patching plan. Learn about our IT infrastructure and cybersecurity services, or get in touch.

Sources