CISA has added CVE-2026-76418 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation of a denial-of-service (DoS) flaw that lets an unauthenticated remote attacker force Cisco Secure Firewall ASA and FTD devices to reload.
What Is It
CVE-2026-76418 is in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. NVD says it is caused by logic errors when secondary authentication is configured on a tunnel group. CISA classifies it as an unchecked return value leading to a NULL pointer dereference (CWE-690).
An attacker can exploit it by sending a crafted request while connecting to the SSL remote access VPN. A successful exploit makes the device reload unexpectedly, which causes a DoS condition. The attacker does not need to log in.
Why It Matters
- Active exploitation confirmed: CISA added the CVE to the KEV catalog on 2026-10-29, which confirms it is being exploited in the wild.
- Short deadline: The KEV due date is 2026-11-01, only three days after it was added.
- Severity: CVSS 3.1 base score 8.6 (HIGH), vector
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. It can be exploited over the network with low complexity, no privileges and no user interaction, and it has a high impact on availability. - Edge exposure: The flaw is in the VPN service of perimeter firewalls. Each reload can cut off remote access and disrupt network traffic.
- Ransomware use: CISA lists known ransomware campaign use as "Unknown."
What's Vulnerable
- Cisco Secure Firewall ASA Software
- Cisco Secure Firewall Threat Defense (FTD) Software
A device is exposed when the Remote Access SSL VPN service is in use and secondary authentication is configured on a tunnel group. The NVD record lists many affected ASA releases in the 9.16, 9.18, 9.19, 9.20, 9.22 and 9.23 trains, including 9.16.4.76, 9.18.4.47, 9.19.1.38, 9.20.3.9, 9.22.1.1 and 9.23.1. The supplied NVD data does not list affected FTD releases. Use the Cisco advisory for the full list of affected and fixed versions. NVD's analysis status is "Undergoing Analysis."
Patch Status
The supplied data does not name fixed software versions. CISA's required action is to apply mitigations according to vendor instructions, following BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. CISA also says to follow the applicable BOD 26-04 guidance for cloud services, or stop using the product if mitigations are unavailable. Stakeholders must assess each asset's internet exposure and follow the BOD 26-04 patching guidelines. Federal agencies must meet the 2026-11-01 due date.