On October 29, CISA added CVE-2026-76418 to its Known Exploited Vulnerabilities (KEV) catalog. Federal agencies have a November 1 remediation deadline. Cisco has issued fixes for affected ASA and FTD software, and says its security response team is aware of active exploitation after learning of it during October. The dates and federal deadline are reported by the Canadian Centre for Cyber Security.
What the vulnerability does and which configurations it affects
CVE-2026-76418 is a denial-of-service (DoS) flaw in Cisco Secure Firewall ASA and Threat Defense (FTD) remote-access SSL VPN software. An unauthenticated remote attacker can send a crafted request to the VPN service and cause a vulnerable firewall to reload. A successful VPN login is not required to reach the affected processing path. The National Vulnerability Database rates the flaw 8.6, High, on CVSS 3.1.
The reported exposure conditions include a vulnerable software release, a reachable remote-access SSL VPN service, and secondary authentication configured at tunnel-group scope. A tunnel group is the configuration that governs a set of VPN connections. Cisco’s security advisory describes the vulnerability and affected software.
For FTD, Cisco advises administrators to review the deployed remote-access VPN policy and the resulting device configuration in Secure FMC or Secure FDM. On ASA, check the relevant tunnel groups, including DefaultWEBVPNGroup when the tunnel-group list is enabled. Disabling that list does not remove the exposure if the default group itself uses secondary authentication.
Reported fixed releases for ASA and FTD
The reported fixed release depends on the software family and branch. Use the row for the installed branch when planning an upgrade. The Cisco advisory and the Canadian Centre for Cyber Security’s release summary list these versions.
| Product | Software branch | Reported fixed release |
| ASA | 9.16 and earlier | 9.16.4.104 |
| ASA | 9.18 | 9.18.4.96 |
| ASA | 9.20 | 9.20.4.50 |
| ASA | 9.22 | 9.22.3.200 |
| ASA | 9.24 | 9.24.1.27 or 9.24.10.1 |
| FTD | 7.0 and earlier | 7.0.11 |
| FTD | 7.2 | 7.2.13 |
| FTD | 7.4 | 7.4.9 |
| FTD | 7.6 | 7.6.7 |
| FTD | 7.7 | 7.7.14 |
| FTD | 10.0 | 10.0.3 |
| FTD | 10.1 | 10.1.1 |
Cisco’s temporary configuration mitigation
Cisco describes disabling secondary authentication on the affected tunnel group as a temporary mitigation. It also describes disabling the tunnel-group list when DefaultWEBVPNGroup does not use secondary authentication. That condition matters: turning off the list alone does not address exposure if the default group still has secondary authentication enabled.
Cisco says the mitigation’s applicability and effectiveness depend on the deployment. It does not fix the vulnerability, so Cisco recommends upgrading to a fixed software release.
