Cisco Secure Firewall ASA/FTD: Denial of service in Remote Access SSL VPN

Summary

Cisco Secure Firewall ASA and FTD Software contain a logic error in the Remote Access SSL VPN service that is triggered when secondary authentication is configured on a tunnel group. An unauthenticated remote attacker can send a crafted request while connecting to the SSL VPN and cause the device to reload unexpectedly, resulting in a denial of service. Cisco reports active exploitation, and CISA has added the CVE to its Known Exploited Vulnerabilities catalog. The impact is limited to availability; no confidentiality or integrity impact is stated.

Affected

• Cisco Secure Firewall ASA Software (multiple 9.16.x and 9.18.x releases listed in the Cisco advisory)
• Cisco Secure Firewall Threat Defense (FTD) Software (multiple 7.0.x, 7.2.x and later releases listed in the Cisco advisory)
• Devices are only affected if the SSL remote access VPN is enabled (webvpn, enable on at least one interface) and secondary authentication is configured on a tunnel group (including DefaultWEBVPNGroup).
• Not affected per Cisco: Cloud-delivered Firewall, Cloud-delivered FMC, Secure Access, Secure FMC Software.

Fixed in

Cisco has released fixed software for the affected releases. The exact fixed versions are listed in the Fixed Software section of the Cisco advisory and were not verified for this entry. Unknown.

Workaround

Cisco's advisory states there are no workarounds, but describes a mitigation:

• If DefaultWEBVPNGroup does not use secondary authentication, run 'no tunnel-group-list enable' in WebVPN configuration mode. Users must then know the correct connection profile name.
• If DefaultWEBVPNGroup uses secondary authentication, remove it with 'no secondary-authentication-server-group'.
• Cisco treats mitigations as temporary and says they can reduce the security posture of the VPN.

Exploitation

• Cisco PSIRT became aware of active exploitation in October 2026 (vendor-confirmed).
• CISA added the CVE to the KEV catalog on 2026-10-29 with a federal due date of 2026-11-01.
• Ransomware use: Unknown.
• Indicators of compromise: Unknown.
• Public exploit code: none found by one tracker (unverified).

Our recommendation

• Check whether the SSL VPN is enabled and whether secondary authentication is configured on any tunnel group, including DefaultWEBVPNGroup.
• Patch affected ASA and FTD devices to a fixed release from the Cisco advisory or Cisco Software Checker. Treat this as urgent because exploitation is active.
• If patching is not possible immediately, apply the Cisco mitigation and accept the reduced VPN security posture as a temporary measure.
• Monitor for unexpected reloads and VPN availability problems, and review logs for crafted SSL VPN connection attempts.
• Limit exposure of the SSL VPN login service where feasible.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 sec.cloudapps.cisco.com
• CISA Known Exploited Vulnerabilities Catalog entry www.cisa.gov
• CISA alert: KEV additions 2026-10-29 www.cisa.gov
• The Hacker News: Cisco patches actively exploited ASA flaw thehackernews.com
• GBHackers: Cisco patches actively exploited SSL VPN vulnerability gbhackers.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:37.