Cisco Secure Firewall ASA/FTD: unauthenticated crafted SSL VPN request reloads the device

CVSS 8.6CVE-2026-76418Firmware, BMC & network fabricKnown exploitedcurated

Impact

A logic error in the Remote Access SSL VPN service lets an unauthenticated attacker send a crafted request that forces the appliance to reload. Where an ASA or FTD pair fronts a datacenter or terminates the VPN that operators and tenants use to reach the fleet, a repeatable remote reload takes out management access and any traffic path through the device - including the route engineers would use to respond. CISA lists it as known exploited, so working exploitation is not hypothetical. Only tunnel groups with secondary authentication configured are described as affected.

Who can reach it

Anyone who can reach the SSL remote access VPN listener, typically the public internet. No authentication and no user interaction required.

What to do

Upgrade to a fixed ASA/FTD release per Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75; this is a device reload, so plan for a failover or an outage window on each firewall. The advisory ties exposure to tunnel groups with secondary authentication configured - review that configuration as the interim check. Given KEV status, treat this as an urgent window rather than a routine one.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-76418 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76418

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.