Cisco published security advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 on 28 October 2026 at 19:15 GMT (29 October 03:15 Perth) for CVE-2026-76418, a vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software that, Cisco says, could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service.

Cisco says the flaw is due to logic errors when secondary authentication is configured on a tunnel group and can be exploited by sending a crafted request when connecting to the SSL remote access VPN; it notes that a successful VPN login is not required to reach the affected processing path.

Devices are affected if they run a vulnerable ASA or FTD release, the SSL remote access VPN login service is reachable, and secondary authentication is configured in the tunnel group scope (including the default tunnel group, DefaultWEBVPNGroup).

Cisco rates the advisory High (CVSS 3.1 base 8.6) and says: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability."

Cisco says there are no workarounds, only a mitigation, and strongly recommends upgrading to a fixed release. Cisco credits Eric Fernald, who found the flaw while resolving a Cisco TAC support case. (source: Cisco)

According to BleepingComputer, Cisco did not provide indicators of compromise or say who is exploiting the flaw. (source: BleepingComputer)