Cisco SSL VPN flaw exploited: workaround and fixes (CVE-2026-76418)
Actively exploited denial-of-service in Cisco ASA and FTD SSL VPN, added to CISA KEV on October 29. Fixed releases and a temporary workaround.
Who is affected
- Cisco Secure Firewall ASA software earlier than fixed releases 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1
- Cisco Secure Firewall Threat Defense (FTD) software earlier than fixed releases 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1
- Any device with a tunnel group (DefaultWEBVPNGroup included) configured with secondary authentication and a reachable SSL VPN service
How to fix
Upgrade ASA and FTD to the fixed release for the deployed branch, per Cisco's advisory of October 28, 2026. In the meantime: remove secondary authentication from every tunnel group, including DefaultWEBVPNGroup. Restrict VPN access to the addresses and ranges actually required, and log unexplained device reloads. If the firewall is run as a managed service, demand written confirmation of the installed fix with the version number.
What happened
Cisco's advisory, published October 28, 2026, describes a denial-of-service flaw in the Remote Access SSL VPN service of ASA and Secure Firewall Threat Defense software. An unauthenticated remote attacker sends a crafted request to a tunnel group configured with secondary authentication; an unchecked return value leads to a NULL pointer dereference (CWE-690) and the device reloads. Cisco rates it high, 8.6 on CVSS 3.1, remotely exploitable with no credentials; NVD carries the same score. CISA added the flaw to its KEV catalog on October 29, 2026 with a November 1 remediation deadline for federal agencies, the signal of documented active exploitation. The Canadian Centre for Cyber Security, in AV26-1102, additionally flags Cisco Smart Software Manager On-Prem builds earlier than 10-202610.
Why it matters to a hotel
The SSL VPN on an ASA or FTD is the door through which ownership, corporate administration, maintenance contractors and remote managers reach the property network: the PMS (property management system), point of sale, access control, building supervision. Active exploitation means that boundary is being probed right now. The stated impact is a device reload: VPN access drops, remote administration stops, and failover behavior becomes the difference between a nuisance and an outage. A reloading firewall is also a convenient smokescreen: an availability incident can mask intrusion work happening elsewhere.
Who is affected
- ASA software earlier than fixed releases 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, 9.24.10.1.
- FTD software earlier than fixed releases 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1.
- Exposure condition: at least one tunnel group (DefaultWEBVPNGroup included) with secondary authentication enabled, and the VPN service reachable.
How to fix
- Identify the software branch running on every ASA or FTD and compare against the fixed-release list in Cisco's advisory.
- Upgrade at the earliest viable slot; a quarterly maintenance calendar is not compatible with a KEV-listed flaw.
- Until patched, remove secondary authentication from all tunnel groups including DefaultWEBVPNGroup: it is Cisco's stated interim mitigation, not a fix.
- Tighten VPN access policies to required ranges only and cut dormant contractor access.
- Log and investigate any unexplained device reload since October 28, 2026.
- For firewalls operated as a managed service, require written confirmation of the installed fix, version number included.
Context
The flaw lands in a hard week for network edges: Palo Alto Networks confirmed October 28 that PHP2Shell is being exploited against its own exposed management interfaces, and Cisco Talos published the KeyDrift framework the same day, planted on SD-WAN controllers by a group linked to Volt Typhoon via CVE-2026-20127. The message for hotel teams is consistent: perimeter and WAN gear are first-class targets, their administration must never be exposed, and their patches do not wait for the next season.