Threat Overview
Cisco PSIRT confirmed active exploitation of CVE-2026-76418 (CVSS 8.6), disclosed October 28, 2026. A logic error in SSL remote-access VPN processing when secondary authentication is configured on affected tunnel groups can let an unauthenticated remote attacker trigger an unexpected Cisco ASA or FTD firewall reload. The resulting impact is denial of service. Cisco has not described remote code execution or credential theft for this CVE.
References
Cisco PSIRT advisory — CVE-2026-76418 (October 28, 2026)
The Hacker News — CISA adds exploited Cisco flaw to KEV (October 30, 2026)
Impacted Systems
Cisco Secure Firewall ASA and Secure Firewall Threat Defense on self-managed hardware/virtual appliances with a reachable SSL remote-access VPN login service and secondary authentication in an applicable tunnel group. A successful VPN login is not required. First fixed ASA releases: 9.16.4.104 (9.16 and earlier), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 or 9.24.10.1. First fixed FTD releases: 7.0.11 (7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. The exposed service is the configured SSL VPN listener, often TCP 443 but deployment-dependent. Cisco confirms Cloud-delivered Firewall, cdFMC, Secure Access and Secure FMC Software are unaffected.
Why this matters
Internet-facing VPN firewalls are high-impact availability targets. An unexpected reload can interrupt remote work and obscure surrounding security events. Customers using vulnerable ASA/FTD SSL VPN with secondary authentication require urgent patching.
Exploitation Status
Cisco PSIRT confirmed active exploitation during October 2026; CISA added the CVE to its Known Exploited Vulnerabilities catalog. Cisco has not published a verified exploit request pattern or campaign-specific IOC set. The KQL below hunts operational symptoms, not definitive CVE signatures.
What this hunt looks for
Cisco SSL VPN errors, failed logins, firewall reload/reboot/watchdog events, repeated restarts and temporal correlation between VPN failures and device reloads.
Required logs
Microsoft Sentinel Syslog and CommonSecurityLog containing Cisco ASA/FTD VPN and device-health messages. Cisco product deployment alone does not confirm that these specific event classes are ingested.
01 — Cisco VPN crash and restart messages
Syslog
| where TimeGenerated >= ago(14d)
| extend Msg=tolower(SyslogMessage)
| where Msg contains "%asa" or Msg contains "%ftd" or Msg contains "webvpn" or Msg contains "cisco"
| where Msg contains "reload" or Msg contains "reboot" or Msg contains "crash" or Msg contains "restart" or Msg contains "watchdog" or Msg contains "traceback"
| project TimeGenerated, HostName, ProcessName, SeverityLevel, SyslogMessage
| order by TimeGenerated desc02 — Cisco VPN login failure bursts preceding possible DoS
CommonSecurityLog
| where TimeGenerated >= ago(14d)
| extend Raw=tolower(strcat(Message," ",Activity," ",AdditionalExtensions))
| where Raw contains "webvpn" or Raw contains "ssl vpn" or Raw contains "anyconnect" or Raw contains "tunnel-group"
| where Raw contains "fail" or Raw contains "denied" or Raw contains "error" or Raw contains "reject"
| summarize Failures=count(), Sample=make_set(substring(Raw,0,180),4) by DeviceName, SourceIP, bin(TimeGenerated,5m)
| where Failures >= 20
| order by Failures desc03 — Repeated Cisco firewall reloads within 24 hours
Syslog
| where TimeGenerated >= ago(14d)
| extend Msg=tolower(SyslogMessage)
| where (Msg contains "%asa" or Msg contains "%ftd" or Msg contains "cisco") and (Msg contains "reload" or Msg contains "reboot" or Msg contains "watchdog" or Msg contains "restart")
| summarize Restarts=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Samples=make_set(SyslogMessage,5) by HostName, bin(TimeGenerated,1d)
| where Restarts >= 2
| order by Restarts desc04 — Cisco VPN error spikes in native syslog
Syslog
| where TimeGenerated >= ago(14d)
| extend Msg=tolower(SyslogMessage)
| where (Msg contains "%asa" or Msg contains "%ftd" or Msg contains "webvpn" or Msg contains "anyconnect") and (Msg contains "authentication" or Msg contains "tunnel" or Msg contains "vpn")
| where Msg contains "fail" or Msg contains "error" or Msg contains "reject" or Msg contains "denied"
| summarize Errors=count(), Examples=make_set(SyslogMessage,4) by HostName, bin(TimeGenerated,5m)
| where Errors >= 25
| order by Errors desc05 — Firewall VPN failure surge and same-host restart correlation
let Failures=Syslog
| where TimeGenerated >= ago(14d)
| extend Msg=tolower(SyslogMessage)
| where (Msg contains "%asa" or Msg contains "%ftd" or Msg contains "webvpn") and (Msg contains "fail" or Msg contains "error" or Msg contains "denied")
| summarize Failures=count() by HostName, Window=bin(TimeGenerated,5m)
| where Failures >= 15;
let Restarts=Syslog
| where TimeGenerated >= ago(14d)
| extend Msg=tolower(SyslogMessage)
| where (Msg contains "%asa" or Msg contains "%ftd" or Msg contains "cisco") and (Msg contains "reload" or Msg contains "reboot" or Msg contains "watchdog")
| project HostName, RestartTime=TimeGenerated, RestartMessage=SyslogMessage;
Failures
| join kind=inner Restarts on HostName
| where RestartTime between (Window .. Window+15m)
| project HostName, Window, Failures, RestartTime, RestartMessage
| order by RestartTime desc06 — Cisco VPN failure or reload signals in normalized firewall logs
CommonSecurityLog
| where TimeGenerated >= ago(14d)
| extend Raw=tolower(strcat(Message," ",Activity," ",AdditionalExtensions))
| where Raw contains "webvpn" or Raw contains "ssl vpn" or Raw contains "anyconnect" or Raw contains "cisco asa" or Raw contains "firepower"
| where Raw contains "reload" or Raw contains "restart" or Raw contains "crash" or Raw contains "tunnel-group" or Raw contains "secondary authentication"
| project TimeGenerated, DeviceName, SourceIP, DestinationIP, DeviceAction, Activity, Message, AdditionalExtensions
| order by TimeGenerated descDetection Notes
The strongest signal is a burst of SSL VPN failures immediately preceding a device reload. Generic AnyConnect/webvpn errors are common and are not a vulnerability-specific exploit signature. A crash can interrupt forwarding before a reload is logged. Routine maintenance, power events and other defects can also explain restarts. Syslog and CommonSecurityLog normalization differ by connector. These hunts were prepared but not executed against customer Sentinel workspaces; no customer-specific finding is asserted.
