Vulnerability · CVE-2026-76418

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

Published Oct 28, 2026 · catalog updated Oct 30, 2026 · Cisco Secure Firewall ASA Software and Cisco Secure FTD Software

Last checked Nov 1, 2026. A connected source was read within the last 7 days.

Patch now

CVE-2026-76418 is in the CISA known-exploited catalog, due Nov 1, 2026. Confirm Cisco Secure Firewall ASA Software and Cisco Secure FTD Software against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Gaps on this record

No version range is stored. A customer cannot check an installed version against this record.

Same product and reporting

New Cisco firewall zero-day being actively exploited · Press · CSO Online
Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls · Press · The Hacker News

Severity: High8.6
Known exploitation: CISA KEV and VulnCheck KEV
EPSS: 0.82%
Remediation: Remediation guidance
Affected products: vendor Cisco · vendor Cisco Cisco Secure Firewall ASA and Cisco Secure FTD · vendor Cisco Secure Firewall ASA Software and Cisco Secure FTD Software

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

vendor Ciscoversion unspecified
vendor Cisco Cisco Secure Firewall ASA and Cisco Secure FTDversion unspecified
vendor Cisco Secure Firewall ASA Software and Cisco Secure FTD Softwareversion unspecified

How to fix CVE-2026-76418

Vendor action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Version check
No version range is stored, so an installed version cannot be checked on this page.
Advisory
Open the bsi record and follow its fix. CISA lists a due date of Nov 1, 2026.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Which versions are affected?

Affected version ranges are not on this record. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

What should an analyst verify?

CWE-690. EPSS 0.82%. The CISA KEV listing is the exploitation evidence. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Cisco security GitLab CE / EE security

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

Oct 28, 2026 · VulnCheck KEV
Detected
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is config
Oct 28, 2026 · CISA KEV
Known exploited
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Oct 29, 2026 · EUVD
Updated
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is config
Oct 30, 2026 · EUVD
Updated
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is config
Nov 1, 2026 · CISA KEV
Remediation due
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

Sources

BSI CERT-BundGovernment advisoryCVE-2026-76418
Cisco Secure Firewall Threat Defense und Cisco ASA: Schwachstelle ermöglicht Denial of Service
wid.cert-bund.de
Canadian Centre for Cyber SecurityGovernment advisoryCVE-2026-76418
Serial number: AV26-1102 Date: October 29, 2026 As of October 28, 2026, Cisco is affected by a vulnerability in the following products: Cisco Secure Firewall Adaptive Security Appliance (ASA) Versions prior to 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.4, 9.24.1.27 and
cyber.gc.ca
CERT-FRGovernment advisoryCVE-2026-76418
Une vulnérabilité a été découverte dans les produits Cisco. Elle permet à un attaquant de provoquer un déni de service à distance. Cisco indique que la vulnérabilité CVE-2026-76418 est activement exploitée.
cert.cyber.gouv.fr
CISA Cybersecurity AdvisoriesGovernment advisoryCVE-2026-76418
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound vulnerability CVE-2026-76418 Cisco Secure Firewall
cisa.gov
CISA KEVConfirmed exploitationCVE-2026-76418
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
cisa.gov
Cisco Security AdvisoriesVendor advisoryCVE-2026-76418
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting i
sec.cloudapps.cisco.com
CVE.orgVulnerability recordCVE-2026-76418
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2026-76418
30-day exploitation probability 0.82%
first.org
EUVDVulnerability recordEUVD-2026-112462
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting i
euvd.enisa.europa.eu
NCSC NetherlandsGovernment advisoryCVE-2026-76418
Cisco heeft een ernstige kwetsbaarheid verholpen in Cisco Secure Firewall Adaptive Security Appliance (ASA) en Cisco Secure Firewall Threat Defense (FTD). Cisco bevestigt dat de kwetsbaarheid actief wordt misbruikt. Deze kwetsbaarheid met kenmerk CVE-2026-76418 heeft een CVSS-sco
advisories.ncsc.nl
Tenable CVE DatabaseVulnerability recordCVE-2026-76418
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is config
tenable.com
VulnCheck KEVConfirmed exploitationCVE-2026-76418
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) co
vulncheck.com

References

Freshness

Last verified in this catalog Oct 31, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

VulnCheck KEVNov 1, 2026
FIRST EPSSOct 31, 2026
Cisco Security AdvisoriesOct 31, 2026
EUVDOct 31, 2026
Tenable CVE DatabaseOct 31, 2026
CISA Cybersecurity AdvisoriesOct 31, 2026
NCSC NetherlandsOct 31, 2026
Canadian Centre for Cyber SecurityOct 31, 2026
CERT-FROct 31, 2026
CISA KEVOct 31, 2026
BSI CERT-BundOct 30, 2026
CVE.orgOct 29, 2026

Priority score

57/100

Evidence confidence: Very high

CISA lists this vulnerability as known to be exploited.

Confirmed exploitation30/30
EPSS probability1/20
CVSS severity13/15
Public exploit0/10
Internet exposure10/10
Product prevalence3/5
Detection0/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

High

CVSS severity
8.6 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EPSS probability
0.82% · p57.31%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
Yes · CISA KEV and VulnCheck KEV
CISA KEV since Oct 28, 2026. Ransomware use: Unknown.
Patch availability
Remediation guidance
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Stacks

Cisco GitLab

Weakness

CWE-690 MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.