Threat reportVulnerabilityTL-2026-4695
Cisco Secure Firewall ASA and FTD Remote Access SSL VPN Denial of Service Vulnerability (CVE-2026-76418) Exploited in the Wild
Cisco Secure Firewall ASA and FTD Remote Access SSL VPN (TL-2026-4695), also tracked as cisco-sa-asaftd-tunnel-dos-s6mgkb75, is a high-severity software vulnerability scored CVSS 8.6, first published 2026-10-29. It has no confirmed attribution, affects Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, references 2 CVEs (CVE-2026-76418, CVE-2026-20349), maps to 4 MITRE ATT&CK techniques (T1133, T1190, T1499.004), and is covered by 9 detection rules and 4 indicators of compromise.
- CVSS
- 8.6/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 4Indicators of compromise
Key facts for TL-2026-4695
- Threat ID
- TL-2026-4695
- Also known as
- cisco-sa-asaftd-tunnel-dos-s6mgkb75, CSCwx26625
- Severity
- HIGH
- CVSS
- 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, telecoms, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 4
How Cisco Secure Firewall ASA and FTD Remote Access SSL VPN works
A logic error when secondary authentication is configured on a tunnel group in Cisco Secure Firewall ASA and Secure FTD software lets an unauthenticated remote attacker send a crafted request to the Remote Access SSL VPN service and force the device to reload. Cisco and HKCERT state the flaw is being exploited in the wild; no IOCs or actor attribution have been published.
CVE-2026-76418 (Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75, Cisco bug ID CSCwx26625) is a flaw in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. Cisco attributes it to logic errors when secondary authentication is configured on a tunnel group. The weakness is classified as CWE-690 (Unchecked Return Value). An unauthenticated, remote attacker can send a crafted request while connecting to the SSL remote access VPN, causing the affected device to reload unexpectedly and producing a denial-of-service condition. CVSS v3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H): network-reachable, no privileges, no user interaction, availability impact only.
Exploitability depends on configuration: SSL remote access VPN must be enabled and secondary authentication must be configured on tunnel groups. Cisco's advisory (published 2026-10-28) states active exploitation is confirmed as of October 2026, and HKCERT's bulletin of 2026-10-29 rates the issue High Risk and states it is being exploited in the wild. Source discrepancies to note for analysts: NVD's CISA-ADP SSVC data (as read on 2026-10-29) still lists exploitation as 'none' with automatable 'yes' and technical impact 'partial', and CISA KEV fields were unpopulated; the portion of the KEV JSON feed that was read (first ~100KB of a 1.8MB document) did not contain this CVE, so KEV status is unverified. The advisory publishes no IOCs, no exploit code analysis, no malware or C2 details, and names no threat actor. The impact is availability loss on perimeter firewall/VPN concentrators, which interrupts remote access and, depending on topology, traffic inspection and transit.
Cisco states there is no permanent workaround. Temporary mitigations are disabling tunnel group lists or removing secondary authentication, at the cost of reduced security or functionality. Fixed releases are listed in the advisory. Credit: discovered by Eric Fernald during Cisco TAC case resolution. Note: this is a distinct issue from the August 2026 Cisco ASA/FTD SSL VPN DoS CVE-2026-20349 (cisco-sa-asaftd-vpn-dos-dzv4mQFF), which is reported separately by The Hacker News and has a different root cause (insufficient error checking in HTTP request processing); the two should not be conflated when scoping detections.
MITRE ATT&CK techniques used in TL-2026-4695
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Persistence
T1133 External Remote Services
Impact
T1499.004 Application or System Exploitation; T1529 System Shutdown/Reboot
Affected products and versions in Cisco Secure Firewall ASA and FTD Remote Access SSL VPN
- Cisco — Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
Vulnerable versions: 9.16 and earlier; 9.18; 9.20; 9.22; 9.23; 9.24
Fixed in: 9.16.4.104; 9.18.4.96; 9.20.4.50; 9.22.3.200; 9.23.1.48; 9.24.1.27; 9.24.10.1 - Cisco — Cisco Secure Firewall Threat Defense (FTD) Software
Vulnerable versions: 7.0 and earlier; 7.2; 7.4; 7.6; 7.7; 10.0; 10.1
Fixed in: 7.0.11; 7.2.13; 7.4.9; 7.6.7; 7.7.14; 10.0.3; 10.1.1
Remediation for Cisco Secure Firewall ASA and FTD Remote Access SSL VPN
Patches
- ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 / 9.24.10.1
- FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1
Immediate actions
- Identify ASA/FTD devices with SSL remote access VPN enabled and secondary authentication configured on a tunnel group
- Upgrade to the first fixed release for your train per cisco-sa-asaftd-tunnel-dos-s6mgkb75
- Monitor affected devices for unexpected reloads/crashes and correlate with inbound SSL VPN connection attempts
Workarounds
- No permanent workaround per Cisco
- Temporary: disable tunnel group lists or remove secondary authentication (reduces security or functionality)
Longer-term hardening
- Maintain high-availability pairs for internet-facing VPN terminators so a single device reload does not remove remote access
- Track Cisco PSIRT advisories for ASA/FTD and subscribe to CISA KEV updates
CVEs associated with Cisco Secure Firewall ASA and FTD Remote Access SSL VPN
Weaknesses (CWE) in Cisco Secure Firewall ASA and FTD Remote Access SSL VPN
Timeline of Cisco Secure Firewall ASA and FTD Remote Access SSL VPN
- Related but distinct: The Hacker News reports exploitation of a different Cisco ASA/FTD SSL VPN DoS flaw (CVE-2026-20349, cisco-sa-asaftd-vpn-dos-dzv4mQFF); shows the same attack surface was already targeted. Date is the article's publication month; not the same CVE.
- CISA KEV catalog snapshot (1,762 entries) examined; CVE-2026-76418 not found in the portion read, so KEV status is unconfirmed.
- CVE-2026-76418 published and last modified in NVD/CVE.org with CWE-690 and CVSS v3.1 8.6; CISA-ADP SSVC lists exploitation as 'none' at the time read, KEV fields unpopulated.
- Cisco makes fixed ASA (9.16.4.104 through 9.24.10.1) and FTD (7.0.11 through 10.1.1) releases available on the advisory publication date; version 1.0 is the only revision and there is no permanent workaround.
- Cisco publishes advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418 (CVSS 8.6) with fixed ASA and FTD releases; the advisory states active exploitation is confirmed as of October 2026.
- Threadlinqs opens TL-2026-4695 to track the exploited Cisco ASA/FTD SSL VPN secondary-authentication DoS.
- HKCERT publishes a High Risk bulletin stating CVE-2026-76418 is being exploited in the wild and directing users to Cisco's patches.
Sources cited for Cisco Secure Firewall ASA and FTD Remote Access SSL VPN
- Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75
- HKCERT: Cisco Products Denial of Service Vulnerability
- CVE Record CVE-2026-76418
- NVD CVE-2026-76418
- CISA Known Exploited Vulnerabilities Catalog (checked; CVE not confirmed present)
- The Hacker News: Cisco ASA and FTD Flaw Exploited (related, distinct CVE-2026-20349)
Detection coverage for TL-2026-4695
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4695 across Splunk SPL, Microsoft KQL and Sigma, covering 4 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.