# Cisco Secure Firewall ASA and FTD Remote Access SSL VPN Denial of Service Vulnerability (CVE-2026-76418) Exploited in the Wild

> A logic error when secondary authentication is configured on a tunnel group in Cisco Secure Firewall ASA and Secure FTD software lets an unauthenticated remote attacker send a crafted request to the Remote Access SSL VPN service and force the device to reload. Cisco and HKCERT state the flaw is being exploited in the wild; no IOCs or actor attribution have been published.

- **Published:** 2026-10-29T02:23:31Z
- **Last reviewed:** 2026-10-29T02:23:31Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4695
- **ID:** TL-2026-4695
- **Severity:** HIGH (CVSS 8.6)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 4 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-76418, CVE-2026-20349

## Description

CVE-2026-76418 (Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75, Cisco bug ID CSCwx26625) is a flaw in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. Cisco attributes it to logic errors when secondary authentication is configured on a tunnel group. The weakness is classified as CWE-690 (Unchecked Return Value). An unauthenticated, remote attacker can send a crafted request while connecting to the SSL remote access VPN, causing the affected device to reload unexpectedly and producing a denial-of-service condition. CVSS v3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H): network-reachable, no privileges, no user interaction, availability impact only.

Exploitability depends on configuration: SSL remote access VPN must be enabled and secondary authentication must be configured on tunnel groups. Cisco's advisory (published 2026-10-28) states active exploitation is confirmed as of October 2026, and HKCERT's bulletin of 2026-10-29 rates the issue High Risk and states it is being exploited in the wild. Source discrepancies to note for analysts: NVD's CISA-ADP SSVC data (as read on 2026-10-29) still lists exploitation as 'none' with automatable 'yes' and technical impact 'partial', and CISA KEV fields were unpopulated; the portion of the KEV JSON feed that was read (first ~100KB of a 1.8MB document) did not contain this CVE, so KEV status is unverified. The advisory publishes no IOCs, no exploit code analysis, no malware or C2 details, and names no threat actor. The impact is availability loss on perimeter firewall/VPN concentrators, which interrupts remote access and, depending on topology, traffic inspection and transit.

Cisco states there is no permanent workaround. Temporary mitigations are disabling tunnel group lists or removing secondary authentication, at the cost of reduced security or functionality. Fixed releases are listed in the advisory. Credit: discovered by Eric Fernald during Cisco TAC case resolution. Note: this is a distinct issue from the August 2026 Cisco ASA/FTD SSL VPN DoS CVE-2026-20349 (cisco-sa-asaftd-vpn-dos-dzv4mQFF), which is reported separately by The Hacker News and has a different root cause (insufficient error checking in HTTP request processing); the two should not be conflated when scoping detections.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1133 External Remote Services
- T1499.004 Application or System Exploitation
- T1529 System Shutdown/Reboot

## Sources

- [Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75)
- [HKCERT: Cisco Products Denial of Service Vulnerability](https://www.hkcert.org/security-bulletin/cisco-products-denial-of-service-vulnerability_20261029)
- [CVE Record CVE-2026-76418](https://www.cve.org/CVERecord?id=CVE-2026-76418)
- [NVD CVE-2026-76418](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-76418)
- [CISA Known Exploited Vulnerabilities Catalog (checked; CVE not confirmed present)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [The Hacker News: Cisco ASA and FTD Flaw Exploited (related, distinct CVE-2026-20349)](https://thehackernews.com/2026/08/cisco-asa-and-ftd-flaw-exploited-in.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4695