CVE-2026-76418
HIGH · 8.6 KEV EPSS 0.9%KEV-confirmed, multiple sources cite in-the-wild exploitation, urgent patch released same day.
What: Denial of service flaw in Cisco ASA and FTD Remote Access SSL VPN service (CVSS 8.6). Unauthenticated remote attacker can force device reload when secondary authentication is configured on tunnel group.
Why it matters: KEV-listed 2026-10-29. Actively exploited in the wild. Cisco patched same day as NVD publish. No authentication required. High impact on firewall availability across affected deployments.
Where it's seen: Widespread security news coverage (Bleeping Computer, The Circuitry), CISA advisory confirmation, analyst discussion ranking it top-5 most-discussed CVEs in 24h. Defender triage ongoing.
RISK: CRITICAL — KEV-listed, unauthenticated remote DoS, active exploitation, zero-day impact on perimeter security.
Description
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- None
- Integrity
- None
- Availability
- High