CVE-2026-76418 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-10-28

Added to CISA KEV: 2026-10-29 1 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
CRITICAL: This vulnerability is actively exploited in the wild — treat as emergency patch priority. Cisco PSIRT confirmed active exploitation in October 2026.
IMMEDIATE: Upgrade affected Cisco ASA and FTD software to fixed releases identified in Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75. Consult the advisory for specific fixed versions per train.
IMMEDIATE WORKAROUND (if patching is not immediately feasible): Remove secondary authentication configuration from SSL VPN tunnel groups, or temporarily disable the Remote Access SSL VPN feature to eliminate the attack surface until patching is complete.
DETECTION: Review device logs (syslog, ASDM, FMC) for unexpected device reloads, repeated SSL VPN connection attempts from single or distributed source IPs, and abnormal tunnel group authentication failures that correlate with reload events.
MONITORING: Deploy rate-limiting or geo-blocking on the SSL VPN interface as a compensating control. Enable connection rate monitoring to detect scanning/exploitation attempts prior to device crash.
NETWORK: If possible, restrict SSL VPN access to known IP ranges (e.g., corporate egress IPs, known remote worker ranges) via ACLs on the outside interface as a defense-in-depth measure.
INTELLIGENCE: Subscribe to Cisco PSIRT advisories and monitor Cisco's Talos threat intelligence for IOCs associated with this exploitation campaign.
PATCH PRIORITY: CRITICAL — Internet-facing infrastructure, no-auth exploit, actively exploited, fully automatable. Patch within 24-48 hours of advisory availability.

🔍 Web Intelligence (Kagi · 2026-10-29)

Summary

CVE-2026-76418 is a critical vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The flaw stems from logic errors that occur when secondary authentication is configured on a tunnel group. It is significant because it allows an unauthenticated, remote attacker to trigger an unexpected device reload, causing a denial of service (DoS) condition on critical network infrastructure.

Exploitation

Active Exploitation: The vulnerability is currently being actively exploited in the wild ^[2]^[3].
Threat Actors: While specific attribution to named threat groups is evolving, the exploitation pattern has been linked to recent attacks targeting Cisco firewall VPN zero-days ^[2].
Tool Availability: Exploitation involves sending a single, specifically crafted SSL VPN connection request to the targeted device ^[4]^[5].
Attack Prerequisites: This is a remote, network-based attack that requires no authentication and no user interaction to execute ^[1].

Affected Products & Patches

Affected Software: Cisco Secure Firewall ASA Software and Cisco Secure Firewall FTD Software with Remote Access SSL VPN configured using secondary authentication ^[1].
Patch Availability: Cisco has released software updates to address this vulnerability. Organizations should consult the official Cisco Security Advisory to identify the specific patched releases for their versions ^[1].
Mitigations: If patching is not immediately feasible, disabling the affected SSL VPN feature or reconfiguring tunnel groups to remove secondary authentication may serve as a temporary workaround, though upgrading is the only effective resolution ^[1].

Impact

Operational Impact: Successful exploitation forces the device to reload, resulting in an immediate denial of service for all users and traffic relying on that firewall for connectivity ^[1].
Business Risk: For internet-facing deployments, this vulnerability represents a high risk to business continuity. Because it can be exploited remotely and without authentication, it allows attackers to repeatedly disrupt critical remote access gateways, potentially leading to significant downtime, loss of secure connectivity for remote workers, and interference with enterprise network operations.

Sources

Cisco Security Advisory: Cisco Secure Firewall Adaptive Security ...
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of servic…
Attackers Exploit Second Cisco Firewall VPN Zero-Day ...
Cisco has patched CVE-2026-76418, an unauthenticated DoS zero-day in ASA and FTD software that has been exploited in the wild.
CVE-2026-76418 - Exploits & Severity
An unauthenticated, remote attacker can send a crafted SSL VPN connection request to cause the Cisco Secure Firewall device to reload ...
Cisco ASA/FTD SSL VPN DoS Exploited (CVE-2026-76418)
Cisco ASA/FTD SSL VPNs can be crashed by one crafted request - and it is being exploited in the wild. 9 detections, 4 IOCs.
Cisco Patches Actively Exploited ASA and FTD VPN Flaw ...
Cisco patched an exploited ASA and FTD SSL VPN flaw that can trigger device reloads when secondary authentication is configured.

🔴 CVE-2026-76418