Cisco's Exploited ASA Bug Crashes the Firewall Before Anyone Logs In. Whether You Are Exposed Depends on One Setting in a Group Named DefaultWEBVPNGroup.
If you run Cisco ASA or Secure FTD with remote access VPN, check your tunnel groups for a secondary authentication server today. That one setting decides whether a stranger can reload your firewall with a single crafted request. CISA's deadline for federal agencies was Sunday, November 1.
Cisco published the advisory on Wednesday, October 28. CISA added the flaw, CVE-2026-76418, to its Known Exploited Vulnerabilities catalog the next day, October 29, with a due date of November 1. Cisco rates it 8.6. It is a NULL pointer dereference caused by an unchecked return value, and the result is that the device reloads. Cisco says it became aware of exploitation in October 2026 and gave no detail on when the attacks began, who is behind them or how many devices were hit.
Whether you are exposed is a configuration question
Cisco's advisory says the bug sits in the remote access SSL VPN service and comes from logic errors when secondary authentication is configured on a tunnel group. An attacker sends a crafted request when connecting to the VPN. Cisco says a successful VPN login is not required to reach the affected processing path, so the attacker does not need credentials.
Cisco lists the conditions for exposure: a vulnerable release of ASA or FTD software, and secondary authentication configured in the tunnel group scope. The check is specific.
If tunnel-group-list enable is configured, check every tunnel group, including the default one, DefaultWEBVPNGroup, for a secondary-authentication-server-group.
If tunnel-group-list enable is absent, or was removed with the no tunnel-group-list enable command, still check DefaultWEBVPNGroup. Cisco says disabling the group list does not remove exposure when the default group uses secondary authentication.
On FTD, review the deployed remote access VPN policy and the resulting running configuration in FMC or FDM.
The second bullet is the one people will miss. Turning off the group list looks like a mitigation and is not one when the default group has a secondary server.
What to do
Apply Cisco's fixed release for your train. We did not read the fixed-version table, because Cisco's advisory page loads it with scripts, so take the release numbers from the advisory itself: cisco-sa-asaftd-tunnel-dos-s6mgkb75.
If you cannot upgrade yet, Cisco's temporary mitigation has two forms. Turn off the tunnel group list if DefaultWEBVPNGroup does not use secondary authentication, or disable secondary authentication on any user-configured tunnel group and on DefaultWEBVPNGroup.
One thing is our reading, not Cisco's. The effect is a reload, so the evidence an attacker leaves is probably unexpected restarts and crash records on the VPN device. Cisco does not say what the exploitation looks like, and we have not seen it.
Why a crash bug is on the must-patch list
KEV lists what CISA has evidence of being exploited, and a denial of service counts. For a firewall that terminates your remote access VPN, a reload cuts off every remote user at once, and an attacker who can repeat it can keep them off. We are not saying this is a prelude to something worse. Nothing we read says so.
We have covered this platform before, including the pre-authentication chain that joined KEV in May. That is a different pair of bugs, and patching one does not fix the other.
What we hold, and what we don't
Cisco published no indicators for this exploitation and KEV carries none, so there are no addresses or hashes to add to our feed, and we added none. We have no sighting of our own, and our edge does not see traffic to anyone's VPN appliance, so we would not expect one. We are citing Cisco and CISA.
Limits
This rests on Cisco's advisory as quoted by The Hacker News and on the CISA KEV catalog entry. We read the advisory page's description text, not the fixed-release table or the affected-version list. The CVSS score of 8.6 and the weakness type are as published by Cisco and CISA. We have not tested any device.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments