Firewalls Cisco ASA e FTD · Exploitation confirmed

Exploited Cisco ASA and FTD VPN Flaw Added to CISA KEV Catalog

Oct 29, 2026 · 2 min read

Cisco has patched CVE-2026-76418 (CVSS 8.6) in Secure Firewall ASA and FTD software and confirms active exploitation in October. An unauthenticated remote attacker sends a crafted request to the SSL VPN service, when secondary authentication is configured on a tunnel group, and forces the device to reload without a VPN login, causing denial of service. CISA added the flaw to its KEV catalog with a federal deadline of November 1, 2026; no complete workaround exists, so a fixed release must be installed.

By HIFY Radar newsroom Updated 10/29/2026 04:43 PM Get this every day →← Back to the feed 7 sources

CriticalVulnerabilityExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Cisco has patched CVE-2026-76418 (CVSS 8.6) in ASA and FTD firewalls and confirmed active exploitation in October, without identifying attackers, targets or scale. A remote attacker, unauthenticated and without a VPN login, sends a crafted request and forces the firewall to reload. CISA added the flaw to the KEV catalog, with a federal patching deadline of November 1, 2026.

Why it matters

A device with a reachable SSL VPN service and secondary authentication on a tunnel group can be crashed repeatedly, stopping remote access and any operation that depends on the firewall. The effect is denial of service; Cisco's advisory reports no confirmed data theft or remote code execution. US federal agencies face a November 1, 2026 deadline.

What to do

Install a fixed release now. ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1. FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. No complete workaround is available.

For the technical team

CVE: CVE-2026-76418
Affected: Firewalls Cisco ASA e FTD · Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software with a reachable SSL VPN service and secondary authentication configured on a tunnel group. The sources do not list affected version ranges, only the fixed releases.
Exploitation: Active exploitation confirmed by Cisco in October; the company did not identify attackers, targets or the scale of the activity. CISA added CVE-2026-76418 to the KEV catalog with a federal remediation deadline of 2026-11-01; ransomware use unknown.
Fix: Fixed ASA releases: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1. Fixed FTD releases: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. No complete workaround is available; administrators are urged to install a fixed release.
Vector: Remote Access SSL VPN service with secondary authentication configured on the tunnel group. Logic errors in the service; CISA describes an unchecked return value leading to a NULL pointer dereference. An unauthenticated remote attacker sends a crafted request while connecting to the SSL VPN service and triggers an unexpected device reload, causing denial of service. A successful VPN login is not required.
More details: Cisco's advisory reports no confirmed data theft or remote code execution and identifies no attackers or victims. The KEV entry requires mitigation per vendor instructions and BOD 26-04 guidance; if mitigations are unavailable, discontinue use of the product under the federal requirement. Press coverage (BleepingComputer) and security accounts describe the flaw as a zero-day.

Timeline

10/29/2026 04:43 PM
CISA adds CVE-2026-76418 to the KEV catalog, with a federal remediation deadline of November 1, 2026.
10/29/2026 01:53 PM
New details: the flaw stems from logic errors in the Remote Access SSL VPN service when secondary authentication is configured; CVSS score 8.6.
10/29/2026 10:55 AM
New advisory details: an unauthenticated crafted request to the SSL VPN service, when secondary authentication is configured on an affected tunnel group, forces the firewall to reload without requiring a VPN login.

Want the next updates in your inbox? Get the daily edition →

See all 6 updates

10/29/2026 08:12 AM
New press coverage highlights the exploited flaw crashes SSL VPN devices on Cisco firewalls.
10/29/2026 08:07 AM
New vendor detail: the flaw scores CVSS 8.6 and lets an unauthenticated remote attacker crash the device.
10/29/2026 07:48 AM
First report: Cisco ships a fix for CVE-2026-76418 and cites active exploitation.