CVE-2026-76418: Unauthenticated DoS in Cisco ASA and FTD SSL VPN Threatens OT Remote Access Perimeters

Executive Summary

CVE-2026-76418 is a logic error in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD Software that lets an unauthenticated, remote attacker force an unexpected device reload by sending a crafted request during VPN connection when secondary authentication is configured on a tunnel group. For OT environments, the physical criticality is the loss of the remote access path and, in deployments where the ASA or FTD also enforces the IT/OT boundary, a loss of the segmentation control plane during each reload cycle.

Technical Exposure Breakdown

The vulnerable component is the SSL remote access VPN handler. The precondition that matters is configuration specific: the tunnel group must have secondary authentication enabled. Organizations that run multi-factor or two-stage authentication on their VPN tunnel groups, which is common guidance for remote OT engineering access, are the ones exposed. This is the uncomfortable part. The control intended to harden remote access is the condition that enables the denial of service.

The attack vector is network-reachable and requires no authentication. An attacker reaching the SSL VPN listener can send the crafted request without valid credentials, meaning the usual argument that VPN access is gated by MFA does not apply to this failure mode. The result is a device reload, which is a denial of service rather than code execution. The CVSS score is 8.6.

Per the grounding data, affected ASA Software spans ranges up to 9.16.4.104, 9.18 through 9.18.4.96, 9.19 through 9.20.4.50, 9.22 through 9.22.3.200, 9.23 through 9.23.1.48, and 9.24.1 through 9.24.1.27. Affected FTD Software spans up to 7.0.11, 7.2.0 through 7.2.13, 7.3.0 through 7.4.9, 7.6.0 through 7.6.7, 7.7.0 through 7.7.14, and 10.0.0 through 10.0.3. Patch status is listed as unknown in our data, so operators should not assume a fixed build is available and should treat mitigation as the primary near-term action. This CVE is flagged in the known exploited vulnerability catalog, which removes the usual window for leisurely change control.

OT Impact and Compliance Risk

In a plant or utility, the ASA or FTD is frequently the device that terminates vendor and engineer remote sessions and often sits at the enforcement point between enterprise and process networks. A repeated reload does two things. It drops active remote sessions, which can interrupt a maintenance or recovery action at the worst possible moment, and if the firewall is also carrying segmentation policy, each reboot removes that boundary until the device comes back up. An attacker who can time reloads can keep the perimeter in a flapping state.

Compliance exposure is direct. Under IEC 62443, this challenges the reliability of your zone and conduit enforcement and your remote access security level claims. Under NERC CIP, an externally routable interactive remote access path through a device that can be reloaded on demand touches CIP-005 and the availability expectations of CIP-007. For pipeline operators, TSA SD-02C requires documented segmentation and access control continuity, and a boundary device that an unauthenticated actor can cycle undermines that. Water and wastewater operators under AWIA 2018 should treat this as a resilience gap in their risk and resilience assessment.

Compensating Controls

Do not rely solely on a patch that may not yet exist for your build. First, restrict exposure of the SSL VPN listener. If the remote access VPN does not need to face the public internet, place it behind a filtering layer that only permits known source ranges or a jump infrastructure. Second, review whether secondary authentication is strictly required on every tunnel group, since that configuration is the trigger condition. Where it can be restructured without weakening overall access control, evaluate alternative authentication designs for affected tunnel groups.

Third, build a virtual patch at a device in front of the firewall. A Suricata rule concept would inspect inbound TLS to the VPN endpoint and alert or drop on anomalous or malformed connection attempts to the SSL VPN handler, giving detection even where you cannot block by source. Fourth, do not run active scanning against the firewall or downstream OT components to confirm exposure, since aggressive probing can reload or brick sensitive industrial equipment. Use passive traffic observation and configuration review instead. Finally, enable high availability pairing where supported so a reload of one unit does not collapse the perimeter.

BreachSpider Intel

BreachSpider tracks exploitation signals and OT exposure for CVE-2026-76418 across ASA and FTD deployments so operators can prioritize mitigation ahead of a confirmed fix.