Secure Firewall ASA (< 9.16.4.104, < 9.18.4.96, < 9.20.4.50, < 9.22.3.200, < 9.23.1.48, < 9.24.1.27) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/secure-firewall-asa--9.16.4.104--9.18.4.96--9.20.4.50--9.22.3.200--9.23.1.48--9.24.1.27/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 10:03:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCisco Secure Firewall ASA and FTD: Denial of Service via SSL VPN (CVE-2026-76418)https://feed.craftedsignal.io/briefs/2026-10-cisco-firewall-dos/Thu, 29 Oct 2026 10:03:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cisco-firewall-dos/Cisco patched an actively exploited logic vulnerability (CVE-2026-76418) in the SSL VPN service of ASA and FTD software that allows unauthenticated attackers to trigger a device reload and denial-of-service condition.Cisco has released security patches for a high-severity vulnerability (CVE-2026-76418) affecting the Remote Access SSL VPN service in Cisco Secure Firewall ASA and FTD software. The flaw, which stems from logic errors when secondary authentication is configured on a tunnel group, can be exploited by an unauthenticated, remote attacker sending a crafted request. Successful exploitation causes the affected device to reload unexpectedly, resulting in a denial-of-service (DoS) condition. Cisco confirmed active exploitation of this vulnerability as of October 2026.

Impact

Successful exploitation allows unauthenticated remote attackers to trigger an unexpected device reload, resulting in a complete denial-of-service for the affected network appliance.

Recommendation

  • Immediately apply the available software patches for your version of Cisco Secure Firewall ASA or FTD.
  • If immediate patching is not feasible, implement the recommended workarounds: disable the tunnel group list if 'DefaultWEBVPNGroup' does not use secondary authentication, or disable secondary authentication on any user-configured or default tunnel groups ('DefaultWEBVPNGroup').
  • Review the deployed remote access VPN policy and current device configuration via Cisco Secure FMC or FDM to identify active secondary authentication configurations.
]]>highthreatcve-2026-76418denial-of-serviceciscovpnnetwork-securityhigh-confidence-source