Cisco ASA 與 FTD 釋出高嚴重度 SSL VPN DoS 漏洞

Cisco ASA and FTD: High-Severity SSL VPN DoS Vulnerability Disclosed

October 29, 2026

Cisco has disclosed a high-severity denial-of-service (DoS) vulnerability affecting its Secure Firewall Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. Tracked as CVE-2026-76418, the vulnerability carries a CVSS v3.1 score of 8.6 and could allow an unauthenticated remote attacker to force an affected firewall to reload unexpectedly.

Published on October 28, 2026, the security advisory highlights a weakness in the Remote Access SSL VPN service. Organizations relying on Cisco firewalls to provide remote connectivity should assess their configurations and prioritize remediation.

What Is CVE-2026-76418?

The vulnerability stems from a logic error in the Remote Access SSL VPN service when secondary authentication is configured for a tunnel group.

An attacker could send a specially crafted request while initiating an SSL VPN connection. If the device is running a vulnerable software release and has the required configuration, processing the request could trigger an unexpected device reload.

A successful attack could interrupt remote connectivity and disrupt network security services provided by the affected firewall.

The vulnerability is classified under CWE-690, which concerns unchecked return values. Cisco has released software updates to address the issue and states that no workaround completely addresses the vulnerability.

How Does the Attack Work?

The attack targets the SSL VPN connection-processing path rather than requiring an authenticated VPN session.

The sequence is straightforward:

Identify an exposed service: The attacker locates a reachable Remote Access SSL VPN endpoint on a potentially vulnerable Cisco firewall.
Target the vulnerable configuration: The firewall must have the affected software version and secondary authentication configured in the relevant tunnel group.
Send a crafted request: The attacker submits a specially constructed request during the SSL VPN connection process.
Trigger a failure: A logic error in request processing can cause the firewall to reload unexpectedly.
Disrupt connectivity: The reload interrupts firewall operations and can cause a denial-of-service condition.

Because authentication is not required, an attacker does not need valid VPN credentials to reach the vulnerable processing path.

The practical impact depends on the affected deployment, including its VPN configuration and the network services that depend on the firewall.

Which Cisco Products Are Affected?

CVE-2026-76418 affects Cisco Secure Firewall ASA and FTD software when the vulnerable release and configuration conditions are present.

Exposure requires the following conditions:

The device runs a vulnerable ASA or FTD software release.
The Remote Access SSL VPN service is enabled and reachable.
Secondary authentication is configured in the relevant tunnel group.

Administrators should review the default DefaultWEBVPNGroup as well as user-configured tunnel groups. Disabling the tunnel-group list does not necessarily eliminate exposure if the default tunnel group still uses secondary authentication.

Cisco has confirmed that Cloud-delivered Firewall, Cloud-delivered Firewall Management Center, Secure Access, and Secure Firewall Management Center software are not affected by this specific vulnerability.

Fixed Software Versions

Cisco has published the following fixed releases.

Cisco Secure Firewall ASA

Release 9.16 and earlier: Upgrade to 9.16.4.104.
Release 9.18: Upgrade to 9.18.4.96.
Release 9.20: Upgrade to 9.20.4.50.
Release 9.22: Upgrade to 9.22.3.200.
Release 9.23: Upgrade to 9.23.1.48.
Release 9.24: Upgrade to 9.24.1.27 or 9.24.10.1.

Cisco Secure Firewall FTD

Release 7.0 and earlier: Upgrade to 7.0.11.
Release 7.2: Upgrade to 7.2.13.
Release 7.4: Upgrade to 7.4.9.
Release 7.6: Upgrade to 7.6.7.
Release 7.7: Upgrade to 7.7.14.
Release 10.0: Upgrade to 10.0.3.
Release 10.1: Upgrade to 10.1.1.

These are the first fixed releases listed in Cisco’s advisory. Administrators should verify the appropriate upgrade path and software compatibility before deployment.

Cisco also describes a temporary mitigation involving disabling secondary authentication on affected tunnel groups. Where applicable, administrators should evaluate this option against their authentication requirements and operational risks. It should not be treated as a substitute for upgrading to a fixed release.