TLP:CLEARSECURITY ADVISORYHRK-SA-2026-1030-08Exploited in the wild
Cisco ASA and FTD VPN DoS (CVE-2026-76418): unauthenticated firewall reload through the SSL VPN
A crafted request to the Remote Access SSL VPN reloads a Cisco Secure Firewall ASA or FTD device, with no login. Cisco disclosed it on October 28 and confirmed exploitation; CISA added it to KEV on October 29. There is no workaround. Patch the affected release, and prove which devices run a vulnerable VPN config.
SEVERITY
High
PEAK CVSS
8.6
AUTH REQUIRED
None
PUBLIC POC
Not confirmed
PUBLISHED
Oct 30, 2026
REVISION
v1.0 · @Melly
Hayrok Research highlight
A firewall is supposed to be the thing that stays up when everything else is under attack. CVE-2026-76418 turns that assumption around: one crafted request to the VPN, and the firewall reboots itself.
No login is required. An unauthenticated packet to the Remote Access SSL VPN drives an unchecked value into a null-pointer dereference, and the device reloads, taking the firewall and every remote worker's VPN down with it. Cisco confirmed it is being exploited and, pointedly, says there is no workaround.
A perimeter device that drops on demand is both an outage and an opportunity. It severs remote access during the window an attacker is active, and it buries the moment in a flood of reconnects. With no configuration to fall back on, the patch is the entire defense, which makes knowing exactly which devices run a vulnerable VPN config the first thing worth proving.
01 · EXECUTIVE SUMMARY
Bottom line
Hayrok Research Lab is tracking an unauthenticated denial-of-service flaw in the Remote Access SSL VPN of Cisco Secure Firewall ASA and FTD software. A crafted request reloads the device, dropping the firewall and its VPN. Cisco disclosed it on Oct 28 and confirmed active exploitation; CISA added it to KEV on Oct 29. Cisco states there is no workaround, so the control is the patch plus knowing which devices run a vulnerable VPN configuration.
KEY JUDGMENTS
01
Cisco PSIRT confirmed active exploitation in October 2026, and CISA added CVE-2026-76418 to its KEV catalog on Oct 29 with a Nov 1 deadline.Observed
02
Impact is availability only. The flaw reloads the device, causing a denial of service; it does not, on its own, grant code execution or data access.Assessed
03
A device is in scope only if it runs a vulnerable release and has Remote Access SSL VPN, IKEv2 with client services, or ZTNA enabled. FMC is not affected.Reproduced
04
Cisco states there is no workaround. The only remediation is a fixed release or hotfix, which makes patch reachability the whole game.Observed
Remote Access SSL VPN service, ASA and FTD software
Weakness
CWE-690 unchecked return value to NULL pointer dereference
Vector
HTTP, pre-authentication, no user interaction
Affected
ASA and FTD releases with a vulnerable VPN config enabled
Scoring
8.6 · CVSS v3.1, availability impact High
Not affected
Secure Firewall Management Center (FMC)
Impact
Device reload and denial of service. No code execution.
EXPOSURE: A VULNERABLE RELEASE PLUS A VPN CONFIG
01ASA or FTD softwareA vulnerable release of ASA or FTD.
02SSL VPN enabledwebvpn on an interface, the primary vector.
03or IKEv2 / ZTNAIKEv2 Remote Access with client services, or ZTNA on FTD.
04ReachableThe VPN service is reachable from the attacker's network.
03 · THREAT ACTIVITY
Exploitation status and timeline
IN THE WILDObservedCisco PSIRT confirmed exploitation.
CISA KEVListed Oct 29Deadline Nov 1 for FCEB.
WORKAROUNDNoneCisco states no workaround exists.
PATCHAvailableFixed releases and hotfixes shipped.
DISCLOSURE AND ACTIVITY TIMELINE · 2026
Oct 28Cisco discloses CVE-2026-76418 and confirms in-the-wild exploitation.
Oct 29CISA adds CVE-2026-76418 to KEV with a federal remediation deadline of Nov 1.
ContextThis is separate from CVE-2026-20349, an earlier ASA and FTD SSL VPN DoS exploited in August 2026.
04 · AFFECTED PRODUCTS
Affected and fixed versions
A vulnerable release alone is not exposure. The device must also have a vulnerable VPN configuration enabled. Confirm the exact fixed train against Cisco's advisory for your platform.
PRODUCT
CONDITION
FIXED IN
STATUS
Cisco Secure Firewall ASA
SSL VPN (webvpn) enabled
Fixed train per Cisco advisory
Fixed
Cisco Secure Firewall FTD
SSL VPN, IKEv2 client services or ZTNA
Fixed train or hotfix per advisory
Fixed
Devices with no VPN config
none of the above enabled
not exposed
Not affected
Secure Firewall Management Center
n/a
no action
Not affected
CONFIRM THE TRAINCisco lists exact fixed releases and hotfix bundles per platform and software train. Confirm the fixed version for your specific ASA or FTD model against Cisco's advisory before scheduling the change.
05 · RECOMMENDED ACTIONS
What to do, in priority order
CriticalImmediately
Internet-facing ASA or FTD with SSL VPNApply the fixed release or hotfix now. Exploitation is active and there is no workaround.
FTD with IKEv2 client services or ZTNASame priority. These configurations are also in scope.
HighWithin the change window
All ASA and FTD with a VPN configPatch to the fixed train for your platform, following Cisco's advisory.
HA pairsPlan the upgrade to preserve VPN availability during the reload window.
MonitoringEnsure device reloads page the on-call team so a DoS attempt is noticed quickly.
HighBefore closing
Every deviceRecord the software version, the enabled VPN config and the fixed train applied as evidence.
WORKAROUNDS
There is no workaround. Cisco states no configuration change addresses the flaw. Only a fixed release or hotfix remediates it.Reduce reachability. Where business allows, restrict which networks can reach the SSL VPN service until patched.Prepare for reload. Schedule the upgrade with HA failover so the required device reload does not drop remote access.Alert on reloads. Confirm an unexpected device reload raises an alert, so a DoS attempt is caught.
06 · DETECTION AND HUNTING
Observables and hunting queries
No file-based indicators apply to a network device DoS. Hunt on device reloads and on exposure of a vulnerable VPN config.
TYPE
OBSERVABLE
SOURCE
Behavior
Unexpected ASA or FTD reload tied to SSL VPN traffic
Device syslog, crashinfo
Exposure
webvpn enabled on an internet-facing interface
Running config
Exposure
A software version below the fixed train for the platform
show version
EXPOSURE · CVE-2026-76418is the SSL VPN enabled
show running-config webvpn | include enable
EXPOSURE · CVE-2026-76418software version versus fixed train
show version | include Version
07 · MITRE ATT&CK
Technique mapping
TACTIC
ID
TECHNIQUE
BASIS
Impact
T1499.004
Endpoint Denial of Service: Application or System Exploitation
Observed
Initial Access
T1190
Exploit Public-Facing Application
Observed
08 · TECHNICAL ANALYSIS
Root cause and attack path
The flaw is an unchecked return value leading to a NULL pointer dereference (CWE-690) in how the Remote Access SSL VPN service processes a request. A crafted request when connecting to the SSL VPN drives the code down a path where a failed call returns a null value that is then used without a check. The dereference crashes the process and reloads the device, a denial of service. No authentication is required.
Impact is availability only: the device drops, taking the firewall and its VPN with it, but the flaw does not by itself yield code execution or data. A device is affected only if it runs a vulnerable release and has Remote Access SSL VPN, IKEv2 Remote Access with client services, or ZTNA enabled. Cisco confirms Secure Firewall Management Center is not affected, and states there is no workaround, so the patch is the only remediation. This is distinct from CVE-2026-20349, an earlier ASA and FTD SSL VPN DoS exploited in August 2026.
An earlier ASA and FTD SSL VPN DoS exploited in August 2026. Same service, separate flaw.
AssessedA perimeter firewall that reloads on an unauthenticated request is both an outage and a cover for other activity. With no workaround, patch reachability is the whole control.
09 · VALIDATION
Confirm remediation
A scheduled change ticket is not a verdict. Each device should end with evidence: a fixed train running, no vulnerable VPN config enabled, or exposed.
01
Inventory ASA and FTD software versions
Across every firewall, not just the internet edge.
show version | include Version
02
Identify the enabled VPN config
SSL VPN, IKEv2 client services or ZTNA. Only these are in scope.
show running-config webvpn | include enable
show running-config crypto ikev2 | include client-services
03
Confirm the fixed train
Compare the running version against Cisco's fixed release for your platform.
# compare show version output to the Cisco advisory fixed train
04
Confirm reachability
Test whether the SSL VPN service is reachable from untrusted networks.
# probe the VPN service from an external vantage point, in scope
05
Confirm reload alerting
Make sure an unexpected reload pages the on-call team.
# verify syslog and monitoring alert on device reload
10 · EXPOSURE SELF-ASSESSMENT
Am I exposed?
CVE-2026-76418
01Do you run Cisco Secure Firewall ASA or FTD software anywhere?
02Is Remote Access SSL VPN, IKEv2 with client services, or ZTNA enabled on any of those devices?
03Is the software version below the fixed train for that platform?
04Is the VPN service reachable from untrusted networks?
ANSWER TO SEE A VERDICT
Pick yes, no or not sure for each question.
11 · REFERENCES AND REVISION HISTORY
References
›Cisco security advisory for CVE-2026-76418
›CISA: Adds two known exploited vulnerabilities, Oct 29, 2026
This advisory will be updated as exploitation activity or vendor guidance changes.
12 · FAQ
Is CVE-2026-76418 being exploited?
Yes. Cisco PSIRT confirmed active exploitation, and CISA added it to the KEV catalog on October 29, 2026, with a November 1 federal deadline.
What is the impact?
Denial of service. A crafted request reloads the device, dropping the firewall and its VPN. It does not, on its own, grant code execution.
Is there a workaround?
No. Cisco states no configuration change addresses the flaw. Apply a fixed release or hotfix.
Which devices are affected?
ASA or FTD running a vulnerable release with Remote Access SSL VPN, IKEv2 client services, or ZTNA enabled. Secure Firewall Management Center is not affected.
VALIDATE YOUR EXPOSURE
Prove your firewall exposure
Hayrok inventories your ASA and FTD devices, identifies which run a vulnerable VPN configuration, and tests reachability from untrusted networks. Every result lands in Evidence Fabric.