On October 29, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76418 to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. The flaw affects Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software, but exposure depends on three VPN configuration conditions being present together.
Which ASA and FTD configurations are exposed?
The reported attack requires a vulnerable software release, a reachable Remote Access SSL VPN service, and secondary authentication configured in the relevant tunnel group. All three conditions matter. A successful VPN login is not required to reach the affected processing path.
An unauthenticated remote attacker can trigger an unexpected firewall reload, causing a denial of service. Cisco’s reported severity rating is CVSS 8.6. The practical check is therefore whether the device’s release and VPN configuration meet the stated conditions, not simply whether it runs ASA or FTD.
Reported fixed releases by software train
New York State’s Office of Information Technology Services lists the following first fixed releases for the affected software trains. Match the installed train to its corresponding version when planning an upgrade. (New York State ITS advisory)
| Cisco software train | Reported first fixed release |
| ASA 9.16 and earlier | 9.16.4.104 |
| ASA 9.18 | 9.18.4.96 |
| ASA 9.20 | 9.20.4.50 |
| ASA 9.22 | 9.22.3.200 |
| ASA 9.24 | 9.24.1.27 or 9.24.10.1 |
| FTD 7.0 and earlier | 7.0.11 |
| FTD 7.2 | 7.2.13 |
| FTD 7.4 | 7.4.9 |
| FTD 7.6 | 7.6.7 |
| FTD 7.7 | 7.7.14 |
| FTD 10.0 | 10.0.3 |
| FTD 10.1 | 10.1.1 |
Temporary mitigations and their security trade-off
Cisco says no workaround addresses the flaw and recommends upgrading. As a temporary measure, administrators can remove secondary authentication from affected tunnel groups. Cisco warns that this makes remote-access VPN less secure.
Disabling the tunnel-group list is relevant only when the default tunnel group does not use secondary authentication. The choice depends on that configuration; it is not a substitute for installing a fixed release.
CISA’s October 29 catalog addition was based on evidence of active exploitation, while the reported impact is an unexpected firewall reload and denial of service.
