Cisco ASA/FTD SSL VPN flaw exploited for DoS
An actively exploited Cisco ASA/FTD vulnerability lets unauthenticated attackers crash devices via crafted SSL VPN requests when secondary authentication is configured.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-76418 as exploited in the wild.
MS-ISAC has issued an advisory on CVE-2026-76418, a denial-of-service vulnerability in Cisco Secure Firewall ASA and FTD software affecting the Remote Access SSL VPN service. The flaw stems from logic errors triggered when secondary authentication is configured on a tunnel group. An unauthenticated remote attacker can send a specially crafted request while connecting to the vulnerable SSL VPN service, causing the affected device to reload unexpectedly and disrupting remote access connectivity.
The advisory states CVE-2026-76418 has been publicly disclosed and is being actively exploited in the wild, elevating urgency for affected organizations. Cisco has released fixed software versions across multiple ASA (9.16, 9.18, 9.20, 9.22, 9.23, 9.24) and FTD (7.0, 7.2, 7.4, 7.6, 7.7, 10.0, 10.1) release branches. Cisco states no workarounds fully address the vulnerability, though a temporary mitigation is available; organizations should consult the official Cisco advisory for details before deployment.
Defenders should prioritize patching to fixed releases given active exploitation, and should review tunnel group configurations using secondary authentication for signs of crash-inducing traffic. Standard vulnerability management practices—automated patch management, vulnerability scanning, and network segmentation—are recommended to reduce exposure of VPN-facing infrastructure.
Mentioned in this report
Detection guidance
Cisco ASA/FTD Process Crash Signal or Traceback Logged
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Cisco ASA/FTD syslog messages showing a process crash (signal caught, traceback). This is consistent with a crash-inducing request to the SSL VPN service, as in CVE-2026-76418 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco ASA/FTD Process Crash Signal or Traceback Logged description: Detects Cisco ASA/FTD syslog messages that indicate an internal process crash (signal caught, traceback). Exploitation of the Remote Access SSL VPN denial-of-service flaw causes unexpected device crashes and reloads, so repeated crash messages near VPN activity are suspicious. tags: - attack.impact - attack.t1499.004 - attack.initial-access - attack.t1190 logsource: product: cisco service: syslog detection: keywords: - '%ASA-1-199010' - Signal 11 caught - 'Traceback:' condition: keywords falsepositives: - Unrelated software bugs that crash an ASA/FTD process, such as a known defect in the running release - Crash testing or diagnostics performed by Cisco TAC level: medium id: da8e3657-22d4-5955-821e-52b2f071a8ca status: experimental author: Vorant references: - https://www.cisecurity.org/advisory/a-vulnerability-in-cisco-secure-firewall-asa-and-ftd-could-allow-for-denial-of-service_2026-124
Cisco ASA/FTD Unexpected Startup After Reload
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Cisco ASA/FTD startup-begin syslog messages. When no change window explains them, they may indicate an unplanned reload caused by SSL VPN denial-of-service exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco ASA/FTD Unexpected Startup After Reload description: Detects Cisco ASA/FTD syslog startup-begin messages (199005). Correlate with change windows and with SSL VPN connection attempts just before the event, because the SSL VPN denial-of-service flaw causes the device to reload unexpectedly. tags: - attack.impact - attack.t1499.004 - attack.initial-access - attack.t1190 logsource: product: cisco service: syslog detection: keywords: - '%ASA-6-199005' - '%ASA-1-199005' - Startup begin condition: keywords falsepositives: - Planned reloads for patching or upgrades during maintenance windows - Power cycling or hardware failover events level: low id: f49dac5a-f1dc-5ac1-aae6-84443d9dc93c status: experimental author: Vorant references: - https://www.cisecurity.org/advisory/a-vulnerability-in-cisco-secure-firewall-asa-and-ftd-could-allow-for-denial-of-service_2026-124
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-cisco-secure-firewall-asa-and-ftd-could-allow-for-denial-of-service_2026-124
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs