CISA Adds Exploited Cisco ASA and FTD VPN Crash Flaw CVE-2026-76418 to KEV

CISA added CVE-2026-76418, a vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software, to its Known Exploited Vulnerabilities catalog on October 29, 2026.

The flaw is in the Remote Access SSL VPN service and could let an unauthenticated, remote attacker force an affected device to reload, causing a denial of service. Cisco says it stems from logic errors when secondary authentication is configured on a tunnel group, and an attacker can trigger it with a crafted request when connecting to the SSL VPN. Cisco rates it High, with a CVSS score of 8.6. CISA classifies it as an unchecked return value to NULL pointer dereference (CWE-690).

Devices are vulnerable only if they run an affected release, the SSL remote access VPN login service is reachable, and secondary authentication is configured in the tunnel group scope. Cisco said in its October 28 advisory that its PSIRT became aware of active exploitation in October 2026.

First fixed ASA releases are 9.16.4.104 (9.16 and earlier), 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1. First fixed FTD releases are 7.0.11 (7.0 and earlier), 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1. There are no workarounds, but Cisco lists a mitigation: disable secondary authentication on tunnel groups, or disable the tunnel group list.

CISA set a November 1, 2026 remediation deadline for federal agencies. Ransomware use is listed as unknown.