Vulnerability in Cisco Secure Firewall ASA & FTD Enables Denial‑of‑Service via Crafted SSL VPN Requests
What Happened — Cisco disclosed CVE‑2026‑76418, a logic error in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD). When secondary authentication is configured on a tunnel group, an unauthenticated attacker can send a specially‑crafted request that forces the appliance to reload, causing a denial‑of‑service (DoS) condition and loss of remote‑access connectivity. The flaw affects all ASA releases prior to 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27/9.24.10.1 and all FTD releases prior to 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1. Cisco has issued patches for the affected versions; no vendor‑provided workaround exists, though a temporary mitigation is described in the advisory.
Why It Matters for Trust & Control Assurance — The incident underscores the need for a robust vulnerability‑management program that provides continuous evidence of patch status, a control objective that maps to many frameworks (e.g., NIST CSF 2.0).
Who Is Affected — Enterprises of all sizes that rely on Cisco ASA/FTD for perimeter security, including government agencies, large‑ and medium‑sized businesses, and service providers across sectors such as finance, healthcare, and cloud hosting.
Recommended Actions
- Verify firmware versions against the list in the advisory.
- Apply the Cisco‑provided security updates immediately.
- If patching cannot be performed within the maintenance window, enable the temporary mitigation described by Cisco and monitor VPN logs for abnormal reload events.
- Incorporate the patch‑status check into your continuous control‑evidence collection process.
Technical Notes
- CVE: CVE‑2026‑76418 (publicly disclosed, actively exploited).
- Attack Vector: Unauthenticated request to the SSL VPN service with secondary authentication enabled.
- Impact: Device reload → DoS of remote‑access services; no data loss reported.
- References: CIS Advisory 2026‑124