Cisco ASA and FTD: A VPN request can restart the firewall

Cisco advisory dated October 28, 2026. Cisco PSIRT confirms the exploitation of CVE-2026-76418, a vulnerability in the SSL VPN service of Secure Firewall ASA and FTD. When secondary authentication is configured on a tunnel group, a specially crafted request by an unauthenticated actor can cause the device to restart unexpectedly. The published impact is a denial of service, not an RCE or connection bypass.

Why a connection request may reach the firewall before identity

A VPN gateway must receive and analyze the first messages from a client before knowing if it is authorized. These messages can specify a group, an authentication flow, and various parameters. When the group uses a second authentication step, the code must manage additional states: first identity absent, pending, validated or refused, then second factor expected or not. Cisco attributes the defect to logic errors in this context. The advisory does not publish the exact field or function that reboots the device; a state machine diagram explains the risk, but should not be presented as the actual code of the exploit.

The lack of privilege in the CVSS vector is consistent with this bug position: malicious traffic arrives before successful authentication. The configuration precondition is essential. An ASA or FTD without a tunnel group configured for secondary authentication does not match the scope described by Cisco, even if it carries the same product family. You must check both dimensions: version and configuration.

Operational risk

A firewall reboot can cut existing VPN sessions, delay reconnections, and disrupt paths that the equipment is protecting. If the attacker can repeat the request, the interruptions can be prolonged; however, the bulletin does not quantify either the duration of the restart or the frequency of success of a campaign. Redundant configurations may limit the visible effect, but actual failover must be tested. Describing this flaw as “just a crash” underestimates the appliance’s position in remote access.

An authorized audit would rely on a laboratory with patched and vulnerable versions, groups with and without secondary authentication, and monitoring of VPN service states. The useful test would be to confirm that the request triggers the fault only in the affected configuration and that the patched version rejects the same input without restarting. Cisco says the discovery occurred while resolving a TAC support case, not in a detailed public PoC; the advisory does not allow publishing an exact verified payload.

Fix and search

Cisco provides no workaround in the advisory and requests updating to a fixed version applicable to the ASA or FTD train being operated. The operations team should note versions, presence of secondary authentication, unexpected reboots, and previous SSL VPN requests. An increase in reboots after login attempts is an investigative signal, not an automatic attribution to this CVE.

The lesson is that the availability of security appliances also depends on its preauthentication paths and configuration combinations. The nominal flow test, with two factors passing, does not cover the malformed states that a hostile client can send.

Primary source: Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75.