CISA Adds Actively Exploited Cisco ASA and FTD Vulnerability to KEV Catalog
CISA added CVE-2026-76418 in Cisco ASA and FTD products to its catalog of known exploited vulnerabilities. The flaw can trigger a device restart and service outage.
Cisco CVE-2026-76418 is a vulnerability in the Remote Access SSL VPN service that Cisco has identified as actively exploited. On October 29, 2026, the U.S. agency CISA added it to the Known Exploited Vulnerabilities (KEV) catalog. The previous day, Cisco released fixes for affected versions of Cisco Secure Firewall ASA and Cisco Secure FTD devices.
The flaw allows an unauthenticated remote attacker to send a specially crafted request and trigger a device restart. The confirmed impact is denial of service (DoS), resulting in an outage of VPN or network functions provided by the firewall. Cisco assigned it a CVSS score of 8.6.
Cisco CVE-2026-76418 Affects a Specific Configuration
Deployments are vulnerable when the SSL VPN remote access service is available and secondary authentication is configured in the relevant tunnel group. It therefore does not automatically affect every ASA or FTD system, but administrators should verify their remote access configurations.
Cisco PSIRT stated that it observed active exploitation of the flaw in October 2026. CISA subsequently added CVE-2026-76418 to its KEV catalog; according to the CISA record, this step was also confirmed by the Canadian Cyber Centre.
Fixed ASA and FTD Releases Are Available
Cisco released fixes for these ASA versions:
- 9.16.4.104
- 9.18.4.96
- 9.20.4.50
- 9.22.3.200
- 9.23.1.48
- 9.24.1.27
- 9.24.10.1
For Cisco Secure FTD, the fixed releases are 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1.
Organizations using the affected SSL VPN configuration should make the update a priority. An outage of the perimeter firewall or remote access could interrupt the work of users connected through VPN, as well as related network services.
Cisco Has Not Yet Disclosed the Scope of the Attacks
The vendor has not disclosed indicators of compromise, the attackers’ identity, the campaign’s scope, or confirmed targets. Likewise, primary sources have not confirmed the number of vulnerable devices exposed to the public or already compromised.
The confirmed impact is limited to denial of service and unexpected restarts. Cisco does not state that CVE-2026-76418 enables remote code execution or data exfiltration.
Further information may come from any indicators of compromise, new versions of Cisco’s security advisory, or additional CISA guidance.
Sources
- Cisco Security Advisory – Confirms the technical mechanism, affected configurations, active exploitation, mitigation, and fixed releases.
- CISA Known Exploited Vulnerabilities Catalog – Lists CVE-2026-76418 in the catalog of vulnerabilities with known exploitation.
- Canadian Centre for Cyber Security – Independently confirms that CISA added the CVE to KEV on October 29, 2026, and that Cisco reports exploitation in the wild.
Verified and updated: October 30, 2026 06:24
