CiscoAnalysisCisco patches actively exploited SSL VPN denial-of-service flaw in ASA and FTD
What happened.Cisco published a security advisory detailing an actively exploited denial-of-service vulnerability in the Remote Access SSL VPN service of its firewall software.
Why it matters.Perimeter firewalls terminate corporate remote access tunnels. When remote unauthenticated packets trigger device crashes, attackers knock enterprise VPN access offline. Network engineering teams must install Cisco maintenance releases immediately. Administrators without immediate patch windows should evaluate secondary authentication settings on remote access tunnel groups.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-76418 with an 8.6 CVSS score, the defect stems from a NULL pointer dereference caused by an unchecked return value.
- Trigger conditions: The crash occurs when administrators configure secondary authentication on an active tunnel group such as DefaultWEBVPNGroup.
- Exploit mechanics: Remote unauthenticated attackers send crafted packets during SSL connection handshakes to crash appliances and trigger reboots.
- Observed exploitation: Cisco and CISA confirmed active exploitation in the wild, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog.
- Remediation releases: Cisco released software updates across ASA release trains 9.16 through 9.24 and FTD release trains 7.0 through 10.1.