# Cisco Patches Actively Exploited ASA/FTD VPN Flaw; CISA Sets a 1 Nov Deadline URL: https://edufabtech.com/news/cisco-asa-ftd-vpn-flaw-exploited-cisa-kev-2026 Section: News · Technology Published: 2026-10-30 Publisher: EduFabTech (https://edufabtech.com) > Cisco confirmed active exploitation of a logic flaw in ASA and FTD SSL VPN tunnel groups that can reload affected devices; CISA added it to its KEV catalog on 29 October 2026. Cisco disclosed on 28 October 2026 that a flaw in the Remote Access SSL VPN service of its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software was being actively exploited, and the US Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities (KEV) catalog the following day, 29 October 2026, alongside a separate GitLab flaw, according to the CISA alert. The vulnerability, tracked as CVE-2026-76418 in Cisco's advisory, carries a CVSS base score of 8.6. Cisco describes it as resulting from "logic errors when secondary authentication is configured on a tunnel group," and says an unauthenticated remote attacker can send a crafted request while connecting to the SSL remote access VPN to force the device to reload, producing a denial-of-service condition. The advisory credits the discovery to Eric Fernald through a Cisco TAC support case, and Cisco states that "the Cisco PSIRT became aware of active exploitation of this vulnerability" during October 2026. Reporting from BleepingComputer notes that the internet-monitoring platform Shadowserver tracks more than 51,000 Cisco ASA SSL VPN devices exposed online, though that count does not distinguish patched systems or honeypots from genuinely vulnerable ones. ![A three-step timeline showing the flaw moving from Cisco's 28 October advisory to CISA's KEV listing to the 1 November federal remediation deadline.](https://edufabtech.com/uploads/2026/10/cisco-asa-ftd-vpn-flaw-exploited-cisa-kev-2026-2.png) *A three-step timeline showing the flaw moving from Cisco's 28 October advisory to CISA's KEV listing to the 1 November federal remediation deadline. — EduFabTech · Own work* ## What is affected, and what is not yet fixed Per Cisco's advisory, the condition requires SSL VPN to be enabled on at least one interface with the "webvpn" keyword configured, and secondary authentication set on a tunnel group used for remote access connections. Cisco lists fixed releases including ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1, and corresponding FTD releases. The advisory states there is no workaround; administrators who cannot upgrade immediately can reduce exposure by disabling secondary authentication on the affected tunnel groups, which removes a layer of authentication rather than closing the flaw. ## Why a reload bug on a firewall matters beyond the firewall The flaw does not grant an attacker code execution or data access — Cisco's own description limits it to an unauthenticated reload, i.e., a denial-of-service condition. But ASA and FTD appliances are widely deployed as the remote-access gateway for university networks, research computing clusters and hospital systems, meaning a repeatable crash exploit can cut off VPN access for an entire campus or lab network at will, with no credential needed. For students and researchers who depend on institutional VPNs to reach lab instruments, restricted datasets or compute clusters from off campus, that is an availability risk rather than a confidentiality one, but it is still a risk that can halt work during a deadline window if an institution's edge device is targeted. For software engineers and security researchers, the bug is also a case study in how a single "logic error" in an authentication branch — not a classic memory-corruption bug — can produce an unauthenticated crash primitive on a security appliance that is designed to be internet-facing by necessity. Cisco's advisory frames it strictly as a DoS vulnerability with no indication of a path to further compromise, and no independent researcher has published an analysis disputing that scope as of this writing. ![A diagram of the attack path: an unauthenticated request to an SSL VPN tunnel group with secondary auth enabled forces the ASA/FTD device to reload.](https://edufabtech.com/uploads/2026/10/cisco-asa-ftd-vpn-flaw-exploited-cisa-kev-2026-3.png) *A diagram of the attack path: an unauthenticated request to an SSL VPN tunnel group with secondary auth enabled forces the ASA/FTD device to reload. — EduFabTech · Own work* ## What the KEV listing requires, and from whom CISA's alert states that Binding Operational Directive 26-04 "reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities." That directive is binding only on US federal civilian executive branch agencies; CISA's KEV catalog entry for CVE-2026-76418 lists a remediation due date of 1 November 2026 for those agencies specifically. CISA's alert separately encourages all organizations to review the catalog and prioritize remediation, but that guidance is voluntary outside the federal government. Universities, research institutes and companies running ASA or FTD elsewhere in the world are not bound by the directive, but face the same exploited vulnerability and the same absence of a workaround, and Cisco's advisory is the authoritative reference for affected versions and fixed releases. ## Sources 1. Cisco. (2026). Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability. Cisco Security Advisories https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75 2. CISA. (2026). CISA Adds Two Known Exploited Vulnerabilities to Catalog. Cybersecurity and Infrastructure Security Agency https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog 3. Sergiu Gatlan. (2026). New Cisco firewall zero-day exploited to crash SSL VPN devices. BleepingComputer https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/ --- Source page: https://edufabtech.com/news/cisco-asa-ftd-vpn-flaw-exploited-cisa-kev-2026 Quote with a link to the source page. © EduFabTech.