NexusSec.A firewall that keeps rebooting is a security problem as well as an outage: remote staff lose access, and every restart is a moment when things can go wrong. This post reflects what was published up to 1 November 2026.
What happened
On 28 October 2026, Cisco published security advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418, rated high with a CVSS score of 8.6. According to the advisory as reported, logic errors in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software let an unauthenticated, remote attacker make the device reload. Cisco has reported active exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 29 October.
Who is affected
Reports on Cisco's advisory say exposure needs three things together:
- an affected ASA or FTD software release;
- the Remote Access SSL VPN login service reachable by the attacker;
- secondary authentication configured on a tunnel group.
Cisco's cloud-delivered firewall and management services are reported as not affected. The impact is denial of service: the device reloads. Reports do not describe code execution or data theft through this flaw.
What to do
- Check your configuration: does any ASA or FTD device run Remote Access SSL VPN with secondary authentication on a tunnel group?
- Upgrade to the first fixed release for your software train. Take the build number from Cisco's advisory or the Cisco Software Checker, because secondary write-ups list different numbers.
- Use Cisco's listed mitigation only as a stopgap until you can upgrade. Reports say there is no complete workaround.
- Watch for unexpected reloads in device logs and monitoring; a run of them can be a sign of attempts.
- Remember that a high-availability pair is not a fix. Both units run the same software, so both are exposed. See firewall high availability.
Not the first this year
In August 2026, Cisco disclosed another exploited denial-of-service flaw in the same SSL VPN area, CVE-2026-20349, also rated 8.6. Two in three months is a reason to keep VPN-facing firewalls on a fast patching cycle; see a patching routine that actually happens and firewall edge attacks.
