Cisco ASA VPN zero-day: CISA sets a November 1 patch deadline

Cisco published an advisory on October 28 for CVE-2026-76418, a flaw in the SSL VPN of its ASA and FTD firewall software that attackers are already using. BleepingComputer reported it on October 29. The same day, CISA added it to its list of exploited flaws, with a deadline of November 1.

If your office VPN runs on a Cisco firewall, someone with no account can make that box restart. The fix is out. Whether you are exposed comes down to one setting.

Only one VPN setup is at risk

Cisco rates the flaw High, with a CVSS score of 8.6. It lets “an unauthenticated, remote attacker” make the device “reload unexpectedly.” The cause, Cisco says, is “logic errors when secondary authentication is configured on a tunnel group.”

So three things must all be true: the firewall runs an unfixed release, its SSL VPN login page is reachable, and a tunnel group uses secondary authentication. A plain one-step VPN login is outside this bug.

Cisco says its security team “became aware of active exploitation” in October 2026. It has not said who is attacking, when it started or how widely, according to The Hacker News. BleepingComputer adds that Cisco gave no indicators of compromise.

The deadline is shorter than most

CISA’s catalog entry, in its KEV data file, sets a due date of November 1, three days after it was added on October 29. That date binds US federal agencies under directive BOD 26-04, not private firms. We read it as CISA’s own signal of urgency, and November 1 is a Sunday.

The pool of targets is large. BleepingComputer cites Shadowserver tracking more than 51,000 Cisco ASA SSL VPN devices exposed online, though not how many are patched. It is also the second exploited crash bug in this VPN this year, after CVE-2026-20349 in August.

The trade-off, in our view: an upgrade means a maintenance window with the VPN down, and the alternative Cisco offers weakens login security. Cisco says there is no workaround.

What to do now

1. Check whether you are exposed. On ASA, look in the running config for the webvpn keyword with SSL VPN enabled on an interface. If tunnel-group-list enable is set, check every tunnel group, including DefaultWEBVPNGroup, for secondary-authentication-server-group. On FTD, check the remote access VPN policy in FMC or FDM, Cisco says.
2. Upgrade to the first fixed release for your train. ASA: 9.16.4.104 (9.16 and earlier), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, or 9.24.1.27 or 9.24.10.1. FTD: 7.0.11 (7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 or 10.1.1.
3. If you cannot patch this weekend, use Cisco’s stopgap. If DefaultWEBVPNGroup does not use secondary authentication, enter no tunnel-group-list enable in WebVPN configuration mode. If it does, remove it with no secondary-authentication-server-group. Cisco warns this “lowers” your VPN security, so treat it as temporary.
4. Watch for unplanned reloads. Cisco published no indicators, so in our view a firewall that restarts on its own is the best sign you have that someone is trying.

Cisco credits Eric Fernald, who found the bug while working a Cisco support case. Patch first, then turn secondary authentication back on.

Sources

• Cisco security advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75, CVE-2026-76418, October 28, 2026
• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog, October 29, 2026
• CISA Known Exploited Vulnerabilities catalog, JSON feed
• BleepingComputer: New Cisco firewall zero-day exploited to crash SSL VPN devices, October 29, 2026
• The Hacker News: Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls, October 29, 2026