CISA adds exploited GitLab and Cisco firewall flaws to KEV
Federal agencies must fix unauthenticated GitLab code execution and a Cisco firewall reload bug by November 1, 2026.
84
CVE-2026-76418
Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth
CISA: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
- CVSS 3.1
- 8.6 high
- EPSS
- <1%p60
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
A logic error in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Threat Defense (FTD) software can make the device reload. An unauthenticated remote attacker triggers it by sending a crafted request while connecting to SSL remote access VPN, but only when secondary authentication is configured on a tunnel group. A successful exploit causes a denial of service. Only those ASA and FTD deployments with that tunnel-group setting are affected.
What to do: Cisco has not listed affected builds or a fixed version; apply Cisco's update for CVE-2026-76418 when it is available. No workaround is stated.
| Product | Affected |
|---|---|
| Cisco Secure Firewall Adaptive Security Appliance (ASA) Software | — |
| Cisco Secure Firewall Threat Defense (FTD) Software | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
KEVCISA Known Exploited Vulnerability
- Affected
- Cisco Secure Firewall ASA Software and Cisco Secure FTD Software
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- cisco
- Products
- adaptive security appliance software, secure firewall threat defense
- Weakness
- CWE-690
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
In the news
11 storiesWarp Panda used VMware ESX zero-day; firewalls rooted and crashed
CISA set November 11 and October 31 federal deadlines; Cisco says CVE-2026-76418 is crashing firewalls with no workaround.
84
CISA adds exploited GitLab RCE and Cisco firewall DoS to KEV
Federal civilian agencies are told to apply fixes for both flaws by November 1, 2026.
82
Cisco patches actively exploited ASA and FTD VPN crash flaw
CVE-2026-76418, scored 8.6, lets unauthenticated attackers reload firewalls when SSL VPN uses secondary authentication.
82
Cisco ASA and FTD SSL VPN flaw exploited to crash devices
CVE-2026-76418, scored 8.6, lets an unauthenticated attacker reload ASA or FTD when secondary authentication is configured; Cisco has fixes but no workaround.
78
Cisco ASA and FTD SSL VPN zero-day crashed firewalls in attacks
Unauthenticated attackers can reload devices that have webvpn and SSL VPN enabled; Cisco found exploitation in October 2026.
78
Cisco patches exploited ASA and FTD SSL VPN flaw CVE-2026-76418
Unauthenticated crafted VPN requests can reload firewalls; CVSS is 8.6 and there is no workaround.
78
Cisco Secure Firewall VPN flaw CVE-2026-76418 exploited to crash devices
Unauthenticated crafted requests reload ASA and FTD devices when SSL VPN secondary authentication is configured; CVSS is 8.6.
78
Cisco says CVE-2026-76418 in Secure Firewall is exploited in the wild
ASA and FTD releases before the listed builds are affected by a remote SSL VPN tunnel denial of service.
76
Cisco patches exploited ASA and FTD SSL VPN zero-day
CVE-2026-76418, CVSS 8.6, lets unauthenticated attackers restart firewalls when secondary authentication is configured.
76
CISA KEV lists Cisco firewall DoS flaw CVE-2026-76418
Unauthenticated remote attackers can reload ASA and Secure FTD devices; the federal due date is November 1, 2026.
74