--- title: "Cisco ASA FTD SSL VPN Flaw: KEV Listing and the Patch List" description: "Cisco patches an exploited denial of service flaw in ASA and FTD firewalls. Fixed releases, exposure conditions, and the governance lesson." url: https://policycortex.com/blog/cisco-asa-ftd-ssl-vpn-kev-dos sealed: 2026-10-30 register: blog/cisco-asa-ftd-ssl-vpn-kev-dos records: 3 digest: sha3:5aaa37f866841256147e780e39b9b301f772c82518c1a552702ea06f70a0a9ca --- # Cisco Firewall Flaw Lets an Attacker Crash SSL VPN Devices Resources / Blog Cisco patches an exploited denial of service flaw in ASA and FTD firewalls. CISA added it to its exploited list on October 29, 2026, with a November 1 due date. Leonard Esere · Sealed 2026-10-30 · Reading time 4 min Filed under: [Cisco](https://policycortex.com/blog/tags/cisco), [ASA](https://policycortex.com/blog/tags/asa), [FTD](https://policycortex.com/blog/tags/ftd), [SSL VPN](https://policycortex.com/blog/tags/ssl-vpn), [denial of service](https://policycortex.com/blog/tags/denial-of-service), [CISA KEV](https://policycortex.com/blog/tags/cisa-kev), [flaw remediation](https://policycortex.com/blog/tags/flaw-remediation) **Summary** - Cisco patches an exploited denial of service flaw in ASA and FTD firewalls. - An unauthenticated attacker can force a vulnerable device to reload. - CISA added the flaw to its exploited list on October 29, 2026. - The fix is a fixed software release, not a setting change. ## What Cisco published Cisco published a security advisory on October 28, 2026. The advisory covers a flaw in the Remote Access SSL VPN service. The service runs on Cisco Secure Firewall Adaptive Security Appliance (ASA) Software. It also runs on Cisco Secure Firewall Threat Defense (FTD) Software. The record is [CVE-2026-76418](https://www.cve.org/CVERecord?id=CVE-2026-76418). Common Vulnerabilities and Exposures (CVE) is the record system for public flaws. The score is 8.6 under Common Vulnerability Scoring System (CVSS). That score sits in the high band. ## What the flaw does The flaw comes from logic errors in the service. The errors appear when secondary authentication is set on a tunnel group. Secondary authentication means a second check after the first login step. An unauthenticated attacker can send a crafted request while connecting to the SSL remote access VPN. Unauthenticated means the attacker needs no login first. A successful exploit forces the device to reload without warning. The result is a denial of service. Remote access sessions drop until the device returns. Cisco states that a successful VPN login is not needed to reach the flawed path. That fact widens exposure to any reachable VPN gateway with the right settings. ## What CISA added The Cybersecurity and Infrastructure Security Agency added [CVE-2026-76418](https://www.cve.org/CVERecord?id=CVE-2026-76418) to its Known Exploited Vulnerabilities (KEV) Catalog on October 29, 2026. CISA adds a flaw to that catalog based on evidence of active exploitation. The catalog sets a November 1, 2026 due date for federal civilian agencies. Cisco states its Product Security Incident Response Team (PSIRT) became aware of active exploitation in October 2026. Cisco has not named an attacker. Cisco has not named victims. Cisco has not shared a scale count or indicators of compromise. Do not claim any of those facts. ## Who is exposed A device is exposed only when three conditions all hold: - It runs a vulnerable ASA or FTD release. - The SSL remote access VPN login service is reachable. - Secondary authentication is set in the tunnel group scope. Check every tunnel group when the tunnel group list is enabled. That list includes the default tunnel group, DefaultWEBVPNGroup. If the list is not enabled, still check DefaultWEBVPNGroup. A hidden default group can carry the same setting. Cisco lists its cloud delivered firewall and Secure Access products as not affected. Cisco also lists Secure Firewall Management Center (FMC) Software as not affected. Cisco also lists cloud delivered Firewall Management Center as not affected. ## What is not reported Cisco reports no confirmed data theft for this flaw. Cisco reports no remote code execution for this flaw. Remote code execution means running attacker code on the device. The confirmed impact is the crash itself, not a takeover. This flaw is distinct from the August 2026 ASA and FTD SSL VPN flaw. That earlier flaw carries a different CVE number. Do not merge the two flaws in one ticket. ## What to patch Cisco strongly recommends a fixed software release. There is no workaround that fully addresses the flaw. Cisco offers one temporary step for teams that cannot patch at once. Disable secondary authentication on the affected tunnel groups. That step weakens VPN login security. Treat it as a stopgap, not a fix. Fixed ASA releases: - 9.16 line: use 9.16.4.104. - 9.18 line: use 9.18.4.96. - 9.20 line: use 9.20.4.50. - 9.22 line: use 9.22.3.200. - 9.23 line: use 9.23.1.48. - 9.24 line: use 9.24.1.27 or 9.24.10.1. Fixed FTD releases: - Use 7.0.11, 7.2.13, 7.4.9, 7.6.7, or 7.7.14. - Use 10.0.3 or 10.1.1. Check the running release after install, not only the planned release. A device marked patched on the wrong release is still exposed. ## The governance lesson A firewall is a boundary device. Its patch record is boundary evidence. An assessor will ask which boundary devices run which release. A spreadsheet that lists firewalls with no release number cannot answer that ask. Record the device, the running release before the patch, and the fixed release after the patch. Record the tunnel group settings you checked. Record the patch date and the scan result after the patch. A ticket marked done with no release number is a claim. PolicyCortex does not patch Cisco devices. PolicyCortex helps teams link proof to requirements. That proof is what an auditor or assessor asks for. ## Sources - [CVE-2026-76418](https://www.cve.org/CVERecord?id=CVE-2026-76418) record, CVE Program - National Vulnerability Database (NVD) record for [CVE-2026-76418](https://nvd.nist.gov/vuln/detail/CVE-2026-76418) - Cisco security advisory, published October 28, 2026 - CISA alert, CISA Adds Two Known Exploited Vulnerabilities to Catalog, October 29, 2026 - Original diagram by PolicyCortex ## Next step Want boundary device patch evidence collected on a schedule, not by spreadsheet? See how [PolicyCortex](https://policycortex.com) reads it from the live tenant. **Questions on this record** **Q: What does unauthenticated mean?** A: It means the attacker needs no login first. **Q: Does this flaw steal data or run code?** A: No. Cisco reports a device reload and a denial of service only. **Q: What is the due date?** A: The exploited list sets November 1, 2026 for federal civilian agencies. **Q: Is there a full workaround?** A: No. Cisco strongly recommends a fixed software release. ## Related records Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page. - **proof.state**: [Proof of State](https://policycortex.com/proof/state). What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained. - **proof.change**: [Proof of Change](https://policycortex.com/proof/change). Who or what altered the environment, under what authority, with before and after state hashes. - **proof.agency**: [Proof of Agency](https://policycortex.com/proof/agency). What a machine was permitted to do before it acted, what it did, and what would have stopped it. - **architecture**: [Architecture](https://policycortex.com/architecture). How the chain is built and where it lives: inside your tenant, with no egress of evidence. ### Further reading in this register | Published | Entry | Reading | |---|---|---| | 2026-10-29 | [Linux Kernel Fragnesia Flaw Joins the CISA Exploited List](https://policycortex.com/blog/fragnesia-linux-kernel-kev-chain): CISA lists a Linux kernel flaw as exploited. It chains with PHP flaws to reach root. Patch, reboot, and prove the running version. | 5 min | | 2026-10-29 | [Veeam Backup Flaw Lets an Attacker Bypass Authorization](https://policycortex.com/blog/veeam-cdp-coordinator-authorization-bypass): Veeam fixes a 9.1 authorization bypass in Backup and Replication 13. Patch to a fixed build and record the build number. | 4 min | | 2026-10-28 | [Adobe Commerce Upload Flaw Joins the Exploited List](https://policycortex.com/blog/adobe-commerce-polyshell-kev-upload-flaw): CISA added the Adobe Commerce upload flaw to its exploited list on October 27, 2026. Stores must patch to the July 2026 build and hunt for planted code. | 4 min | Verify the record this entry describes. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book) Dates of record - **Published**: 2026-10-30 - **Last updated**: Unchanged since sealing - **Author**: Leonard Esere - **Record**: https://policycortex.com/blog/cisco-asa-ftd-ssl-vpn-kev-dos ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | HEAD | 04788760f861 | a3cdbfd0d6f8 | | REC 0001 | BODY | cc19a8f2fecd | 04788760f861 | | REC 0002 | RELATED RECORDS | 5aaa37f86684 | cc19a8f2fecd | Head sha3:5aaa37f866841256147e780e39b9b301f772c82518c1a552702ea06f70a0a9ca. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.