# Cisco ASA/FTD SSL VPN flaw exploited for DoS

Published: 2026-10-30 · Severity: high · Sectors: Government (National)
Canonical: https://vorant.io/reports/d42442ad-60bc-52f2-b5d0-5cc38a960a93/cisco-asa-ftd-dos-flaw-exploited-in-wild
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> An actively exploited Cisco ASA/FTD vulnerability lets unauthenticated attackers crash devices via crafted SSL VPN requests when secondary authentication is configured.

Source: cisecurity.org — https://www.cisecurity.org/advisory/a-vulnerability-in-cisco-secure-firewall-asa-and-ftd-could-allow-for-denial-of-service_2026-124

## What to check

- Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-76418 as exploited in the wild.

MS-ISAC has issued an advisory on CVE-2026-76418, a denial-of-service vulnerability in Cisco Secure Firewall ASA and FTD software affecting the Remote Access SSL VPN service. The flaw stems from logic errors triggered when secondary authentication is configured on a tunnel group. An unauthenticated remote attacker can send a specially crafted request while connecting to the vulnerable SSL VPN service, causing the affected device to reload unexpectedly and disrupting remote access connectivity.

The advisory states CVE-2026-76418 has been publicly disclosed and is being actively exploited in the wild, elevating urgency for affected organizations. Cisco has released fixed software versions across multiple ASA (9.16, 9.18, 9.20, 9.22, 9.23, 9.24) and FTD (7.0, 7.2, 7.4, 7.6, 7.7, 10.0, 10.1) release branches. Cisco states no workarounds fully address the vulnerability, though a temporary mitigation is available; organizations should consult the official Cisco advisory for details before deployment.

Defenders should prioritize patching to fixed releases given active exploitation, and should review tunnel group configurations using secondary authentication for signs of crash-inducing traffic. Standard vulnerability management practices—automated patch management, vulnerability scanning, and network segmentation—are recommended to reduce exposure of VPN-facing infrastructure.

## Mentioned in this report

- Vulnerabilities: CVE-2026-76418 (KEV)

## Detection guidance (public sample)

### Cisco ASA/FTD Process Crash Signal or Traceback Logged

ATT&CK: T1499.004

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs cisco syslog logs. Status: experimental. Generated from the report; not run against telemetry.

Detects Cisco ASA/FTD syslog messages showing a process crash (signal caught, traceback). This is consistent with a crash-inducing request to the SSL VPN service, as in CVE-2026-76418 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cisco ASA/FTD Process Crash Signal or Traceback Logged
description: Detects Cisco ASA/FTD syslog messages that indicate an internal process
  crash (signal caught, traceback). Exploitation of the Remote Access SSL VPN denial-of-service
  flaw causes unexpected device crashes and reloads, so repeated crash messages near
  VPN activity are suspicious.
tags:
- attack.impact
- attack.t1499.004
- attack.initial-access
- attack.t1190
logsource:
  product: cisco
  service: syslog
detection:
  keywords:
  - '%ASA-1-199010'
  - Signal 11 caught
  - 'Traceback:'
  condition: keywords
falsepositives:
- Unrelated software bugs that crash an ASA/FTD process, such as a known defect in
  the running release
- Crash testing or diagnostics performed by Cisco TAC
level: medium
id: da8e3657-22d4-5955-821e-52b2f071a8ca
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-cisco-secure-firewall-asa-and-ftd-could-allow-for-denial-of-service_2026-124
```

### Cisco ASA/FTD Unexpected Startup After Reload

ATT&CK: T1499.004

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs cisco syslog logs. Status: experimental. Generated from the report; not run against telemetry.

Detects Cisco ASA/FTD startup-begin syslog messages. When no change window explains them, they may indicate an unplanned reload caused by SSL VPN denial-of-service exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cisco ASA/FTD Unexpected Startup After Reload
description: Detects Cisco ASA/FTD syslog startup-begin messages (199005). Correlate
  with change windows and with SSL VPN connection attempts just before the event,
  because the SSL VPN denial-of-service flaw causes the device to reload unexpectedly.
tags:
- attack.impact
- attack.t1499.004
- attack.initial-access
- attack.t1190
logsource:
  product: cisco
  service: syslog
detection:
  keywords:
  - '%ASA-6-199005'
  - '%ASA-1-199005'
  - Startup begin
  condition: keywords
falsepositives:
- Planned reloads for patching or upgrades during maintenance windows
- Power cycling or hardware failover events
level: low
id: f49dac5a-f1dc-5ac1-aae6-84443d9dc93c
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-cisco-secure-firewall-asa-and-ftd-could-allow-for-denial-of-service_2026-124
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-cisco-secure-firewall-asa-and-ftd-could-allow-for-denial-of-service_2026-124

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/05db1ff7-af45-585c-9495-6f47c185c154/cisco-asa-ftd-ssl-vpn-flaw-exploited-for-dos.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup