1-minute read
What a defender needs to know
Cisco reports active exploitation of CVE-2026-76418, a flaw in ASA and FTD remote-access SSL VPN that lets an unauthenticated connection force an affected firewall to reload. The exposure requires a vulnerable software release, a reachable VPN login service, and secondary authentication in a tunnel group processed by that login flow. A successful login is unnecessary.
Check the running ASA or FTD release against Cisco’s fixed-release table. In the running configuration, inspect webvpn and the enabled SSL VPN interface. When tunnel-group-list enable is present, inspect every tunnel group, including DefaultWEBVPNGroup, for secondary-authentication-server-group; when the list is disabled, inspect the default group. FTD operators should compare the deployed policy in Management Center or Device Manager with the device running configuration.
Upgrade to the fixed release for the device’s train and verify its running build afterward. Cisco offers conditional temporary mitigations: disabling the group list changes profile selection, while removing secondary authentication from the default group weakens login security. Test authorized VPN connections after either change.