Cisco patches CVE-2026-76418 in ASA

Cisco has fixed CVE-2026-76418, a vulnerability in the Remote Access SSL VPN service of Secure Firewall ASA and FTD that can be exploited by an unauthenticated remote attacker to trigger an unexpected device reload and cause a denial of service. The flaw carries a CVSS score of 8.6 and has been reported as actively exploited by multiple response and monitoring organizations.

What does CVE-2026-76418 allow?

The vulnerability enables a denial-of-service attack against Cisco Secure Firewall ASA and FTD devices. According to the CVE record, an attacker can send a crafted request that triggers an unexpected reload of the equipment. The practical effect is to make the remote SSL VPN service unavailable.

SecurityWeek said exploitation requires three specific conditions: the firewall must be running a vulnerable version, the SSL VPN login service must be reachable, and secondary authentication must be configured in an affected tunnel group. BleepingComputer added that Cisco detected evidence of exploitation during October 2026.

Which versions did Cisco patch?

Cisco released fixed versions for several ASA and FTD branches. For ASA, the fixed releases are 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, and 9.24.10.1. For FTD, the fixes correspond to 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1, according to CSO Online.

The Canadian Centre for Cyber Security said in alert AV26-1102 that exposure affected versions earlier than those fixed branches. The Center for Internet Security, meanwhile, said Cisco issued updates and a temporary mitigation, although there is no complete workaround.

What temporary mitigation did Cisco recommend?

Cisco did not offer a complete workaround, according to BleepingComputer, but recommended disabling secondary authentication in DefaultWEBVPNGroup or in the affected tunnel groups for administrators who could not update immediately. That measure targets the component that, according to the sources reviewed, is associated with the exploitation.

A technical analysis by the Cyber Threat Observatory attributed the root cause to a logic error in how secondary authentication requests are handled, linked to a null pointer dereference caused by an unchecked return value, although that point appears as a technical assessment from that source and not as an official Cisco confirmation. The same report said SSL Remote Access VPN had to be enabled through webvpn enable on an interface.

What do the official and regional advisories say?

The Center for Internet Security said CVE-2026-76418 was publicly disclosed and is being actively exploited. The Canadian Centre for Cyber Security included it in alert AV26-1102 and said Cisco indicated active exploitation. HKCERT also published an independent bulletin that classified the flaw as a denial-of-service vulnerability and reproduced the exploitation condition with a crafted request against the SSL remote access VPN service.

Cybersecurity News said Cisco’s advisory did not identify specific attackers or victims and did not report confirmed data theft or remote code execution. That observation describes the content of the advisory, but it is not independent evidence that those impacts did not occur.