Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:

Vulnerable Products This vulnerability affects Cisco devices if they are running a vulnerable release of Cisco Secure Firewall ASA Software or Cisco Secure FTD Software, the SSL remote access VPN login service is reachable, and secondary authentication is configured in the tunnel group scope that is described in the following sections. For information which Cisco software releases are vulnerable, see the Fixed Software section of this advisory. Determine the SSL Remote Access VPN Configuration If the running configuration contains the webvpn keyword and SSL VPN is enabled on at least one interface, the configuration is vulnerable, as shown in the following table: Cisco Secure Firewall ASA Software and Secure FTD Software Feature Vulnerable Configuration SSL Remote Access VPN 1 webvpn enable 1. For Cisco Secure FTD Software, remote access VPN features are enabled from Devices > VPN > Remote Access in Cisco Secure Firewall Management Center (FMC) Software or from Remote Access VPN in Cisco Secure Firewall Device Manager (FDM). Determine the Tunnel Group Configuration If tunnel-group-list enable is configured, check all tunnel groups, including the default tunnel group, DefaultWEBVPNGroup , for secondary-authentication-server-group . Note: This check is not limited to profiles that are displayed in the group list on the login page. If tunnel-group-list enable is absent or has been removed using the no tunnel-group-list enable command, check the default tunnel group, DefaultWEBVPNGroup , for secondary-authentication-server-group because disabling the group list does not remove exposure when that default group uses secondary authentication. Note: On Cisco Secure FTD Software, review the deployed remote access VPN policy and the resulting device running configuration in Cisco Secure FMC Software or Cisco Secure FDM. A successful VPN login is not required to reach the affected processing path. Products Confirmed Not Vulnerable Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability. Cisco has confirmed that this vulnerability does not affect the following Cisco products: Cloud-delivered Firewall (CDFW) Cloud-delivered Firewall Management Center (cdFMC) Secure Access (CSA) Secure FMC Software

This vulnerability affects Cisco devices if they are running a vulnerable release of Cisco Secure Firewall ASA Software or Cisco Secure FTD Software, the SSL remote access VPN login service is reachable, and secondary authentication is configured in the tunnel group scope that is described in the following sections.

For information which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.

Determine the SSL Remote Access VPN Configuration

If the running configuration contains the webvpn keyword and SSL VPN is enabled on at least one interface, the configuration is vulnerable, as shown in the following table:

Determine the Tunnel Group Configuration

If tunnel-group-list enable is configured, check all tunnel groups, including the default tunnel group, DefaultWEBVPNGroup , for secondary-authentication-server-group .

Note: This check is not limited to profiles that are displayed in the group list on the login page.

If tunnel-group-list enable is absent or has been removed using the no tunnel-group-list enable command, check the default tunnel group, DefaultWEBVPNGroup , for secondary-authentication-server-group because disabling the group list does not remove exposure when that default group uses secondary authentication.

Note: On Cisco Secure FTD Software, review the deployed remote access VPN policy and the resulting device running configuration in Cisco Secure FMC Software or Cisco Secure FDM. A successful VPN login is not required to reach the affected processing path.

Products Confirmed Not Vulnerable

Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.

Cisco has confirmed that this vulnerability does not affect the following Cisco products:

Cloud-delivered Firewall (CDFW)

Cloud-delivered Firewall Management Center (cdFMC)

There are no workarounds that address this vulnerability. However, there is a mitigation, which is to disable secondary authentication on any user-configured tunnel group list or on the default tunnel group, DefaultWEBVPNGroup . Case 1: If DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel group list. In WebVPN configuration mode, enter no tunnel-group-list enable . With the tunnel group list disabled, users will no longer be able to choose a connection profile (the tunnel-group name) from a provided list and instead will need to know the correct profile to use. Case 2: If DefaultWEBVPNGroup uses secondary authentication, use the no secondary-authentication-server-group CLI command to remove secondary authentication. With secondary authentication disabled, the security posture is lowered for remote access VPN. While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality, performance, and/or security posture of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Cisco strongly recommends upgrading to the fixed software listed in the Fixed Software section of this advisory.

There are no workarounds that address this vulnerability. However, there is a mitigation, which is to disable secondary authentication on any user-configured tunnel group list or on the default tunnel group, DefaultWEBVPNGroup .

Case 1: If DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel group list. In WebVPN configuration mode, enter no tunnel-group-list enable . With the tunnel group list disabled, users will no longer be able to choose a connection profile (the tunnel-group name) from a provided list and instead will need to know the correct profile to use.

Case 2: If DefaultWEBVPNGroup uses secondary authentication, use the no secondary-authentication-server-group CLI command to remove secondary authentication. With secondary authentication disabled, the security posture is lowered for remote access VPN.

While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality, performance, and/or security posture of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

Cisco strongly recommends upgrading to the fixed software listed in the Fixed Software section of this advisory.

Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory. Fixed Releases In the following tables, the left column lists Cisco software releases. The right column indicates whether a release is affected by the vulnerability that is described in this advisory and the first release that includes the fix for this vulnerability. Customers are advised to upgrade to an appropriate fixed software release as indicated in this section. Cisco Secure Firewall ASA Software Release First Fixed Release 9.16 and earlier 9.16.4.104 9.18 9.18.4.96 9.20 9.20.4.50 9.22 9.22.3.200 9.23 9.23.1.48 9.24 9.24.1.27 9.24.10.1 Cisco Secure FTD Software Release First Fixed Release 7.0 and earlier 7.0.11 7.2 7.2.13 7.4 7.4.9 7.6 7.6.7 7.7 7.7.14 10.0 10.0.3 10.1 10.1.1 The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory. Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software To help customers determine their exposure to vulnerabilities in Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software, Cisco provides the Cisco Software Checker . This tool identifies any Cisco security advisories that impact a specific software release and the earliest release that fixes the vulnerabilities that are described in each advisory (“First Fixed”). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities that are described in all the advisories that the Software Checker identifies (“Combined First Fixed”). To use the tool, go to the Cisco Software Checker page and follow the instructions. Alternatively, use the following form to for vulnerabilities that affect a specific software release. To use the form, follow these steps: Choose which advisories the tool will -all advisories, only advisories with a Critical or High Security Impact Rating (SIR) , or only this advisory. Choose the appropriate software. Choose the appropriate platform. Enter a release number-for example, 9.20.3.4 for Cisco Secure Firewall ASA Software or 7.4.2 for Cisco Secure FTD Software. Click Check . For instructions on upgrading a Cisco Secure FTD device, see the appropriate Cisco Secure FMC upgrade guide . Additional Resources For help determining the best Cisco Secure Firewall ASA, Secure FMC, or Secure FTD Software release, see the following Recommended Releases documents. If a security advisory recommends a later release, Cisco recommends following the advisory guidance. Cisco Secure Firewall ASA Compatibility Cisco Secure Firewall ASA Upgrade Guide Cisco Secure Firewall Threat Defense Compatibility Guide

Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.

In the following tables, the left column lists Cisco software releases. The right column indicates whether a release is affected by the vulnerability that is described in this advisory and the first release that includes the fix for this vulnerability. Customers are advised to upgrade to an appropriate fixed software release as indicated in this section.

The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.

Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software

To help customers determine their exposure to vulnerabilities in Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software, Cisco provides the Cisco Software Checker . This tool identifies any Cisco security advisories that impact a specific software release and the earliest release that fixes the vulnerabilities that are described in each advisory (“First Fixed”). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities that are described in all the advisories that the Software Checker identifies (“Combined First Fixed”).

To use the tool, go to the Cisco Software Checker page and follow the instructions. Alternatively, use the following form to for vulnerabilities that affect a specific software release. To use the form, follow these steps:

Choose which advisories the tool will -all advisories, only advisories with a Critical or High Security Impact Rating (SIR) , or only this advisory.

Choose the appropriate software.

Choose the appropriate platform.

Enter a release number-for example, 9.20.3.4 for Cisco Secure Firewall ASA Software or 7.4.2 for Cisco Secure FTD Software.

For instructions on upgrading a Cisco Secure FTD device, see the appropriate Cisco Secure FMC upgrade guide .

For help determining the best Cisco Secure Firewall ASA, Secure FMC, or Secure FTD Software release, see the following Recommended Releases documents. If a security advisory recommends a later release, Cisco recommends following the advisory guidance.

Cisco Secure Firewall ASA Compatibility Cisco Secure Firewall ASA Upgrade Guide Cisco Secure Firewall Threat Defense Compatibility Guide

Exploitation and Public Announcements

In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.

In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.

This vulnerability was found by Eric Fernald during the resolution of a Cisco Technical Assistance Center (TAC) support case.

This vulnerability was found by Eric Fernald during the resolution of a Cisco Technical Assistance Center (TAC) support case.

Cisco Security Vulnerability Policy

To learn Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy . This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco. For additional information on Cisco's vulnerability management, disclosure cadence, and software patching strategy, see Cisco's Transition to a Risk-Based Vulnerability Disclosure Model .

To learn Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy . This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

For additional information on Cisco's vulnerability management, disclosure cadence, and software patching strategy, see Cisco's Transition to a Risk-Based Vulnerability Disclosure Model .

Related to This Advisory

Version Description Section Status Date 1.0 Initial public release. - Final 2026-OCT-28 Show Less

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.

Leave additional feedback