Cisco Secure Firewall Adaptive Security Appliance (ASA) Software: attackers can knock it offline
OFFICIAL NAME: Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
WHAT IT IS · VPN, FIREWALL OR GATEWAYIt sits at the edge of your network and faces the internet, so attackers can reach it directly.
DO THIS FIRSTIf you have it, patch it today. If you cannot, block access to it from the internet until you can. Not sure if you use it? Send this page to your IT provider or security lead and ask.
TECHNICAL SUMMARY A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
WHY THIS VERDICT Attacks are confirmed. The vulnerability is 13 days old, so many systems are likely still unpatched. It affects a product that faces the internet or gives remote access.
WHY IT RANKS HERE Exploitation is confirmed by an authoritative source. The product faces the internet or gives remote access. The confirmation is 13 days old.
- HIGHEST CONFIRMED RUNG
- EXPLOITED
- CISA KEV
- LISTED
- EXPLOIT CODE
- NONE KNOWN
How far has it climbed?
01 TALK
■ CONFIRMEDNEWEST EVIDENCE · 5 INDEPENDENT SOURCESCVE-2026-76418 discussed publicly (CIRCL sighting). CVE-2026-76418 discussed publicly (CIRCL sighting).
- SRC: CIRCL Vulnerability-Lookup sightings: CVE-2026-76418 discussed publicly (CIRCL sighting) · NOV 5
- SRC: Security Affairs: U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog · OCT 30
- SRC: The Hacker News: Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls · OCT 29
- SRC: SecurityWeek: Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August · OCT 29
02 EXPOSED
□ NOT TRACKED YETNO SOURCE FOR THIS STEP YETWe have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.
03 TRIED
■ CONFIRMEDNEWEST EVIDENCE · 3 INDEPENDENT SOURCESAttacks that worked are confirmed (step 4), so attempts count as confirmed too.
- SRC: CIRCL Vulnerability-Lookup sightings: Exploitation of CVE-2026-76418 reported (CIRCL sighting) · NOV 1
- SRC: CISA Known Exploited Vulnerabilities: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability · OCT 28
- SRC: CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-76418 as actively exploited · OCT 28
04 EXPLOITED
■ CONFIRMEDNEWEST EVIDENCE · 3 INDEPENDENT SOURCESExploitation of CVE-2026-76418 reported (CIRCL sighting). Exploitation of CVE-2026-76418 reported (CIRCL sighting).
- SRC: CIRCL Vulnerability-Lookup sightings: Exploitation of CVE-2026-76418 reported (CIRCL sighting) · NOV 1
- SRC: CISA Known Exploited Vulnerabilities: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability · OCT 28
- SRC: CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-76418 as actively exploited · OCT 28
05 DAMAGE
□ NOT TRACKED YETNO SOURCE FOR THIS STEP YETBreach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.
When each thing happened
- DISCLOSED
- EXPLOIT CODE PUBLICNOT YET
- FIRST ATTACK REPORT
- CISA KEV LISTING
- US FEDERAL DEADLINE
THE FIX
CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Nov 1, 2026, has passed. It is a US government deadline; use it as a guide.
Questions to ask this week
- Do we run Cisco Secure Firewall Adaptive Security Appliance (ASA) Software? If yes, is it patched or cut off from the internet?
- Who owns fixing it, and by what date?
- Have we checked for signs of attack since the first report, not just since the patch?
How it unfolded
- Attack activity. OCT 28, 2026CISA Vulnrichment marks CVE-2026-76418 as actively exploited
- Attack activity. OCT 28, 2026Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
- OCT 29, 2026Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
- OCT 29, 2026Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
- OCT 29, 2026Cisco security advisory (AV26-1102)
- Attack activity. OCT 29, 2026Exploitation of CVE-2026-76418 reported (CIRCL sighting) (2 reports, latest NOV 1)
- OCT 29, 2026CVE-2026-76418 discussed publicly (CIRCL sighting) (52 reports, latest NOV 5)
- OCT 30, 2026U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog
SOURCES
- [1] CIRCL Vulnerability-Lookup sightings: CVE-2026-76418 discussed publicly (CIRCL sighting), NOV 5
- [2] CIRCL Vulnerability-Lookup sightings: Exploitation of CVE-2026-76418 reported (CIRCL sighting), NOV 1
- [3] Security Affairs: U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog, OCT 30
- [4] Canadian Centre for Cyber Security: Cisco security advisory (AV26-1102), OCT 29
- [5] The Hacker News: Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls, OCT 29
- [6] SecurityWeek: Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August, OCT 29
- [7] CISA Known Exploited Vulnerabilities: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability, OCT 28
- [8] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-76418 as actively exploited, OCT 28
- [9] CIRCL Vulnerability-Lookup sightings: 52 more reports