Exposure Focus
All verdicts

Evidence as of 2026-11-09 (UTC) · Review by 2026-11-23

Cisco ASA and FTD SSL VPN denial of service also cisco-sa-asaftd-tunnel-dos-s6mgkb75

CVE-2026-76418

Tier 2 · Urgent

A crafted request to the SSL remote access VPN can make a Cisco ASA or FTD firewall reload, with no login, when secondary authentication is configured on a tunnel group. It is being exploited. The only effect is an outage, not a breach, so it matters most where the VPN is business-critical.

This tier is for “All conditions true, VPN is business-critical”. Other placements are higher or lower; see below.

Denial of serviceBreaks: Availability

Verdict by placement

Your tier depends on where it runs. Find the line that matches your setup.

  • Tier 2

    All conditions true, VPN is business-critical

    Out-of-cycle: upgrade, or apply Cisco's mitigation first if you cannot upgrade yet.

    Why Tier 2
    • Reachable from the internet.
    • Cisco and CISA say it is being exploited.
    • No login needed.
    • The effect is a device reload (denial of service only). Nobody gets in.
    • Losing the VPN hurts the business, but the device restarts on its own, so the impact is significant rather than critical.

    Rubric: Reachable. Business impact: significant. Evidence: exploited.

  • Tier 3

    All conditions true, VPN is a backup

    Schedule the upgrade sooner than your normal cycle.

    Why Tier 3
    • Same as above, but losing the VPN for a while is tolerable, so the impact is limited.

    Rubric: Reachable. Business impact: limited. Evidence: exploited.

  • Tier 4

    Any condition false

    No special action. Routine patching.

    Why Tier 4
    • Cisco lists every condition as required, so the device is not vulnerable if any one is false.

    Rubric: A vendor-stated exposure condition is false, so this is not exposed. Routine patching.

Does this apply to you?

Do you run a Cisco ASA or FTD with SSL remote access VPN and secondary authentication on a tunnel group?

How to checkAll of these must be true for a device to be vulnerable. It runs a vulnerable release (see the fixed releases below). The SSL remote access VPN login service is reachable. The running configuration contains webvpn with SSL VPN enabled on at least one interface. A tunnel group has secondary-authentication-server-group. If tunnel-group-list enable is set, check every tunnel group including DefaultWEBVPNGroup, not just the ones shown on the login page. If it is not set, check DefaultWEBVPNGroup. On FTD, review the deployed remote access VPN policy in FMC or FDM. A successful VPN login is not needed to reach the affected code.

If you cannot tell, answer Yes.

Patch and mitigate

There is one way in. Each option below says which it closes and which it leaves open.

  • ACrafted request to the SSL remote access VPN login service

  1. Upgrade to a fixed release

    Vendor-stated

    AClosed

    Cisco strongly recommends upgrading. First fixed releases for ASA are 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 and 9.24.1.27 or 9.24.10.1. For FTD they are 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. Use Cisco's Software Checker for your exact release.

    Effort
    A firmware upgrade and a restart of each firewall, which interrupts the VPN unless you have a failover pair.
    Might break
    Upgrades can change behaviour. Test on a lab or standby unit first.
    Check it worked, undo, guides
    Check it worked
    Confirm the running version on each firewall is at or above the first fixed release for its train.
    Undo
    Boot the previous image. This reopens the flaw.

  2. Remove the tunnel group list (when the default group has no secondary authentication)

    Vendor-stated

    AClosed for that app

    Cisco's mitigation, if DefaultWEBVPNGroup does not use secondary authentication: enter no tunnel-group-list enable in WebVPN configuration mode. Cisco calls this a mitigation, not a workaround, and says it was tested in a lab and is temporary.

    Effort
    One configuration command on each affected firewall.
    Might break
    Users can no longer pick a connection profile from a list at login and must know the correct profile name.
    Check it worked, undo, guides
    Check it worked
    Confirm tunnel-group-list enable is gone from the running configuration, and that DefaultWEBVPNGroup has no secondary-authentication-server-group.
    Undo
    Re-enter tunnel-group-list enable. This reopens the flaw.

  3. Disable secondary authentication on the default group

    Vendor-stated

    AClosed for that app

    Cisco's mitigation, if DefaultWEBVPNGroup does use secondary authentication: use no secondary-authentication-server-group. Removing the group list does not help in that case.

    Effort
    One configuration command, and a plan for how users will authenticate instead.
    Might break
    Cisco says the security posture of remote access VPN is lowered, because the second factor is removed.
    Check it worked, undo, guides
    Check it worked
    Confirm no tunnel group, including DefaultWEBVPNGroup, still has a secondary authentication server group.
    Undo
    Restore the secondary authentication server group. This reopens the flaw.

The detail behind this call

Evidence

3 items, as of 2026-11-09
Vendor advisory · Vendor-stated
Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75, published 2026-10-28, version 1.0. A flaw in the Remote Access SSL VPN service lets an unauthenticated remote attacker make the device reload, causing denial of service. It is caused by logic errors when secondary authentication is configured on a tunnel group. CVSS 3.1 base score 8.6, rated High, with no confidentiality or integrity impact.
As of 2026-11-09 · Source for Vendor advisory
Exploit evidence · Vendor-stated
Cisco states that in October 2026 its PSIRT became aware of active exploitation.
As of 2026-11-09 · Source for Exploit evidence
CISA KEV · Vendor-stated
Listed as a Cisco Secure Firewall ASA and FTD unchecked return value to NULL pointer dereference flaw. Added 2026-10-29, federal due date 2026-11-01.
As of 2026-11-09 · Source for CISA KEV

Any CVSS (Common Vulnerability Scoring System, a general severity score) figure quoted is for reference. It did not set a tier.

Analysis

Cisco lists two mitigations that avoid an upgrade. Cisco says there are no workarounds, and calls both mitigations temporary. It recommends upgrading.

The call would move up if the impact were shown to go beyond a reload, or if exploitation became widespread enough to stop access across many organisations.

Sources

2