cisco-sa-asaftd-tunnel-dos-s6mgkb75HighCVSS 8.6

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

Published
October 28, 2026
Last Modified
October 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-76418 →

📋 Description

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

CVE-2026-76418 — Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability (CVSS 3.1 8.6, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)

🎯 Affected products225

  • Cisco 3000 Series Industrial Security Appliances (ISA)
  • Cisco ASA 5500-X Series Firewalls
  • Cisco Adaptive Security Virtual Appliance (ASAv)
  • Cisco Firepower 1000 Series
  • Cisco Firepower 2100 Series
  • Cisco Firepower 4100 Series
  • Cisco Firepower 9000 Series
  • Cisco Secure Firewall 1200 Series
  • Cisco Secure Firewall 200 Series
  • Cisco Secure Firewall 3100 Series
  • Cisco Secure Firewall 4200 Series
  • Cisco Secure Firewall 6100 Series
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
  • Cisco Secure Firewall Threat Defense (FTD) Software
  • Cisco Secure Firewall Threat Defense Virtual
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.1
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.1.28
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.2
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.2.11
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.2.13
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.2.14
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.2.3
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.2.7
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.3
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.3.14
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.3.15
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.3.19
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.3.23
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.3.3
  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.4
  • +195 more not shown

✅ Remediation

Cisco has released software updates that address this vulnerability. https://software.cisco.com Workarounds: There are no workarounds that address this vulnerability. However, there is a mitigation, which is to disable secondary authentication on any user-configured tunnel group list or on the default tunnel group, DefaultWEBVPNGroup. Case 1: If DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel group list. In WebVPN configuration mode, enter no tunnel-group-list enable. With the tunnel group list disabled, users will no longer be able to choose a connection profile (the tunnel-group name) from a provided list and instead will need to know the correct profile to use. Case 2: If DefaultWEBVPNGroup uses secondary authentication, use the no secondary-authentication-server-group CLI command to remove secondary authentication. With secondary authentication disabled, the security posture is lowered for remote access VPN. While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality, performance, and/or security posture of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco strongly recommends upgrading to the fixed software listed in the Fixed Software ["#fs"] section of this advisory.

🔗 References (6)