Cisco disclosed a high-severity flaw in the Remote Access SSL VPN service of its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) that is being actively exploited to crash devices. The vulnerability, tracked as CVE-2026-76418 with an 8.6 severity rating, stems from logic errors when secondary authentication is configured on a tunnel group. An unauthenticated attacker can send a crafted request to the SSL remote access VPN, causing a device reload and denial-of-service. The advisory says any configuration containing the webvpn keyword with SSL VPN enabled on at least one interface is vulnerable, and specific checks are required for tunnel-group-list enable and the default tunnel group DefaultWEBVPNGroup. Cisco offers no workarounds but has released fixes for ASA versions 9.16.4.104 through 9.24.10.1 and FTD versions 7.0.11 through 10.1.1, and recommends disabling secondary authentication as a temporary mitigation. 1