CVE-2026-76418CVSS 8.6SSL VPN secondary-authentication denial of service
An unauthenticated SSL VPN request can trigger an unexpected device reload. Successful login is unnecessary; the reported impact is denial of service, not code execution.
Cisco confirms exploitation of an ASA/FTD SSL VPN reload flaw
CVE-2026-76418 lets an unauthenticated attacker force ASA/FTD reloads through SSL VPN when the relevant tunnel group uses secondary authentication. Cisco confirms active exploitation and publishes fixed releases.
- Disclosed
- Oct 28, 2026
- Updated Oct 29, 2026
- Severity
- CVSS 8.6
- 1 CVE tracked here
- Splash zone
- Vulnerable ASA/FTD with reachable SSL remote access VPN and secondary authentication in the relevant tunnel group
- cisco
- In the wild
- Yes
- Cisco PSIRT reports active exploitation in October 2026.
What happened
Cisco’s exploitation confirmation warrants L4. The authentication setting is a prerequisite, not a requirement for attacker credentials. No victim count or attacker IoCs are supplied. The vendor labels the configuration changes temporary mitigations despite the advisory’s “no workarounds” banner. Hiding the group list is insufficient when the default group itself uses secondary authentication.
CISA added CVE-2026-76418 to KEV on October 29. The November 1 deadline applies to FCEB agencies; the entry does not impose the GitLab flaw’s forensic-triage flag. This is additional confirmation of the same DoS event, not a new RCE or a new victim count.
What’s in the bowl
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Cisco ASA 9.16 and earlier | 9.16.4.104 | Patched |
| Cisco ASA 9.18 | 9.18.4.96 | Patched |
| Cisco ASA 9.20 | 9.20.4.50 | Patched |
| Cisco ASA 9.22 | 9.22.3.200 | Patched |
| Cisco ASA 9.23 | 9.23.1.48 | Patched |
| Cisco ASA 9.24 | 9.24.1.27 | Patched |
| Cisco ASA 9.24, additional listed target | 9.24.10.1 | Patched |
| Cisco FTD 7.0 and earlier | 7.0.11 | Patched |
| Cisco FTD 7.2 | 7.2.13 | Patched |
| Cisco FTD 7.4 | 7.4.9 | Patched |
| Cisco FTD 7.6 | 7.6.7 | Patched |
| Cisco FTD 7.7 | 7.7.14 | Patched |
| Cisco FTD 10.0 | 10.0.3 | Patched |
| Cisco FTD 10.1 | 10.1.1 | Patched |
Crime-scene timeline
Oct 28, 19:15 UTC
Cisco publishes fixes and confirms exploitation
Oct 29, 2026
CISA adds the flaw to KEV with a November 1 deadline
The catalog confirms exploitation; its forensic-triage flag is No and ransomware use is Unknown.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Cisco PSIRT advisoryPrimaryExploitation confirmed; affected configuration, release matrix and conditional mitigations.
- Cisco CNA recordPrimaryCVSS 3.1 score 8.6, unauthenticated reload impact and exploitation statement.
- Cisco CSAF release dataPrimaryMachine-readable copy of the advisory and fixed-release matrix.
- CISA KEV catalogPrimaryAdded October 29 with November 1 due date; forensic triage No and ransomware involvement Unknown.