Cisco advisory October 28, 2026; CISA KEV catalog addition October 29, 2026
Cisco ASA and FTD VPN Flaw Under Active Exploitation: CISA Sets a November 1 Deadline
Cisco published fixes on October 28 for CVE-2026-76418, a flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense software, and said its Product Security Incident Response Team became aware of active exploitation in October 2026. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 29 with a November 1, 2026 remediation due date for federal agencies. The flaw, scored 8.6 under CVSS 3.1 and classified as CWE-690, an unchecked return value leading to a NULL pointer dereference, stems from logic errors when secondary authentication is configured on a tunnel group. An unauthenticated remote attacker who can reach the SSL VPN login service can send a crafted request during connection and force an affected device to reload, causing a denial of service; no successful login is required. A device is in scope only when it runs an affected release, the SSL remote access VPN login service is reachable, and secondary authentication is configured in the tunnel group scope, including the default group DefaultWEBVPNGroup. Cisco lists no workarounds and strongly recommends upgrading. First fixed ASA releases include 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1, with corresponding first fixed FTD releases 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1. Reporting based on Shadowserver counts put more than 51,000 Cisco ASA SSL VPN devices exposed online, a figure that does not distinguish patched systems or honeypots from vulnerable ones. Cisco gives no details on who is exploiting the flaw or how widely, and CISA lists ransomware campaign use as unknown. A temporary mitigation discussed in coverage, disabling secondary authentication or the tunnel group list, removes a layer of authentication rather than closing the flaw.
Executives
This flaw does not steal data. It knocks the front door for remote work offline, on demand, without a password, and it is already being used. For organizations whose staff reach internal systems through Cisco VPN, the exposure is an availability decision: a planned upgrade window this weekend, or an unplanned outage at an attacker-chosen moment. The federal deadline is November 1.
CIO / CISO
Scope before scheduling: list every ASA and FTD device running Remote Access SSL VPN, confirm the login service is reachable, and check every tunnel group, including DefaultWEBVPNGroup, for secondary authentication, because disabling the group list does not remove exposure when the default group uses it. Upgrade to the first fixed release for your train. If you use the stopgap of disabling secondary authentication, record it as a temporary weakening of login security with a date to restore it after the upgrade.
Engineers
Verify the running configuration, not the login page: on FTD, review the deployed remote access VPN policy and the resulting running configuration in the management console. Treat any unexplained reload of an internet-facing ASA or FTD device during October as a possible exploitation sign and preserve crash and reload records before the upgrade overwrites them. Plan the upgrade so remote users keep an alternate path in during the window.
Everyone (non-IT)
If your work VPN drops or your office firewall restarts for an update in the next few days, this is the likely reason. A short planned interruption now is what prevents a longer unplanned one later, and no action is needed from individual users beyond installing what IT sends through its normal channel.