Cisco ASA and FTD: a VPN with secondary authentication reloads
CVE-2026-76418 reloads Cisco ASA and FTD on SSL VPN when a tunnel group has secondary authentication. This is denial of service, not a way into the network. There is no workaround. There is a patch. CISA added it on 29 October.
Staff connect to the office, the gateway reloads, remote access drops for everyone at once. CVE-2026-76418 is that story. A bug in Remote Access SSL VPN on Cisco Secure Firewall ASA and FTD. An outsider does not need a login. The tunnel group has to have secondary authentication, and the outsider has to be able to reach that VPN. The result is a reload, not a shell. Cisco advisory: cisco-sa-asaftd-tunnel-dos-s6mgkb75. In October PSIRT confirmed exploitation, and on 29 October CISA listed it.
What to update
First fixed ASA builds: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and for 9.24 either 9.24.1.27 or 9.24.10.1. FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1. Take the row for your branch from the advisory, not "the biggest number in the table." Cisco does not offer a workaround. They describe temporarily turning secondary authentication off as a weakening of the VPN. That is not a substitute for the upgrade.
If the VPN has no second factor, this particular bug does not hit you. That is a configuration check, not the model name on the sticker.
Related Lexora services
The office VPN sits on an ASA
We can look at the branch and whether secondary authentication is on. Without that, the advisory is either yours or it is not.