If your Cisco firewall runs its remote access VPN, a stranger can make it reboot. Update it.

What it is

Cisco’s advisory says an attacker with no login can trigger a programming error over the network (CISA lists it as an unchecked return value leading to a null pointer dereference) and make the device reload. It isn’t a break-in: nothing is stolen and nobody gets inside. But a firewall that reboots on command takes the whole office offline each time, and the attacker can keep doing it.

It’s the second flaw like this on Cisco firewalls this year. CISA added a similar ASA and FTD reload bug, CVE-2026-20349, in August.

Are you exposed?

Cisco says a device is affected only when all three of these are true:

• The SSL remote access VPN is turned on. On ASA, that’s the webvpn setting enabled on at least one interface. On FTD, check Remote Access VPN in Firewall Management Center (Devices, then VPN, then Remote Access) or in Device Manager.
• The VPN sign-in service is reachable, which for most offices means from the internet.
• A tunnel group uses a secondary authentication server. Check every tunnel group, including DefaultWEBVPNGroup, not only the ones listed on the sign-in page.
• Cisco says its cloud-delivered firewall, cloud-delivered Firewall Management Center, Secure Access and Secure FMC are not affected.

Fixed releases

• ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1.
• FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1.
• If your release line isn’t listed, Cisco’s advisory and its Software Checker show which release to move to.

What to do

1. Update to a fixed releaseCisco says there’s no workaround. The Software Checker on the advisory page gives the first fixed release for your exact version.
2. If you can’t update this weekCisco describes a stopgap. If DefaultWEBVPNGroup doesn’t use secondary authentication, turn off the group list on the sign-in page (the command is “no tunnel-group-list enable”), so users type their connection profile name instead of picking it. If it does, remove secondary authentication from it (“no secondary-authentication-server-group”), which Cisco notes lowers the VPN’s security. Treat either one as temporary.
3. Look for unexplained restartsIf the firewall has rebooted on its own lately, its logs are worth a look.

For the other office firewalls and routers on CISA’s list this fall, see our roundup. If you’re not sure what’s in your network closet or who updates it, tell us about it.

Sources

• Cisco security advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75
• Rescana: Cisco Secure Firewall ASA and FTD CVE-2026-76418
• NVD: CVE-2026-76418
• CISA Known Exploited Vulnerabilities catalog