← All incidentsSecurity flaw·Major
Fix availableAttackers already use itAffects website owners
CCisco Secure Firewall ASA and FTD
What it changes for you
Some company VPNs may drop; site owners must update.
A flaw in Cisco ASA and FTD firewalls lets anyone on the internet make the device restart when its web VPN uses a certain login setup. Cisco says attackers already use it.
Started Oct 28, 2026Updated Oct 29, 2026
What should I do?
- You
- Nothing to do.
- If you run a website or an app
- Upgrade Cisco ASA or FTD to the first fixed release for your branch. Until then, if the SSL VPN uses secondary authentication in a tunnel group, follow Cisco's mitigation steps in the advisory.
What is affected
- CCisco Secure Firewall ASA and FTDFixed in 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, 9.24.10.1, 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1
CVE-2026-76418Severity score 8.6 out of 10
Timeline
Fix available · Oct 29, 2026
CISA adds CVE-2026-76418 to its Known Exploited Vulnerabilities catalog.
CISAFix available · Oct 28, 2026
Cisco publishes CVE-2026-76418, a flaw that lets a remote attacker reload ASA and FTD devices, and says it knows of active exploitation. Fixed releases are available.
Cisco