TL;DR: CVE-2026-76418 is a known-exploited vulnerability in Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Then confirm no exposed, unpatched instance remains on your perimeter.
What CVE-2026-76418 is
According to the public vulnerability record, A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
CISA summarises it as: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
Affected product & severity
CVE-2026-76418 affects Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. Confirm exact affected and fixed versions against the vendor's advisory.
| Property | Detail |
|---|---|
| CVE | CVE-2026-76418 |
| Vendor | Cisco |
| Product | Secure Firewall ASA Software and Cisco Secure FTD Software |
| CVSS | 8.6 (HIGH) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
| Weakness | CWE-690 |
| Added to CISA KEV | 2026-10-29 |
Why it is urgent
This CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-29) — a list of flaws with confirmed exploitation in the wild. US federal agencies are required to remediate KEV entries on a deadline; for everyone else it is a strong signal to prioritise this now rather than wait. There is no proof-of-concept or exploit detail in this advisory by design.
What to do now
- Follow CISA's required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Apply the vendor's patch or mitigation for Cisco Secure Firewall ASA Software and Cisco Secure FTD Software on every affected instance, per the official advisory linked below.
- Inventory every instance — production, staging, legacy and third-party appliances that bundle it. You cannot patch what you have forgotten you run.
- Verify the version actually deployed, not the one you think you run; the risk is the build actually serving traffic.
- Check for internet exposure. A known-exploited flaw on a reachable instance is an active risk — confirm none is exposed that should not be.
How to confirm your exposure
The hard part of a known-exploited CVE is rarely the patch — it is knowing where a reachable, unpatched instance still exists: a forgotten host, a staging box that drifted public, a third-party appliance. AssurePort's network and host penetration testing discovers exposed services, fingerprints their versions, and correlates them against known-exploited vulnerabilities — so a newly-weaponised CVE is checked against your real external footprint, including the hosts you don't have on a list. That is the window continuous testing is built to close.
Sources & further reading: NVD CVE-2026-76418 and the CISA KEV catalog are the authority on affected and fixed versions. Vendor/independent analysis: sec.cloudapps.cisco.com, cisa.gov. This advisory contains no exploit code.
Frequently asked questions
What is CVE-2026-76418?
CVE-2026-76418 is a vulnerability in Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, rated HIGH (CVSS 8.6), listed in the CISA Known Exploited Vulnerabilities catalog.
Is CVE-2026-76418 being exploited?
Yes — it is in the CISA KEV catalog (added 2026-10-29), which lists vulnerabilities with confirmed in-the-wild exploitation. Treat it as an active, prioritise-now risk.
Which products are affected?
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. Confirm the exact affected and fixed versions against the vendor's official security advisory before acting.
What should I do right now?
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Then inventory every instance, verify the version actually deployed, and confirm none is exposed and unpatched on your perimeter.