> ## Content Index
> Fetch the complete content index at: https://stackurity.dev/blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# Cisco ASA and FTD flaw CVE-2026-76418 is exploited
- URL: https://stackurity.dev/blog/cisco-asa-ftd-cve-2026-76418-exploited-vpn-dos/
- Published: 2026-10-30T01:35:08.000Z
- Updated: 2026-10-30T01:35:08.000Z
- Description: CISA lists Cisco ASA and FTD flaw CVE-2026-76418 as exploited. It can crash firewalls through the VPN service. See who is affected and what we do not cover.
- Author: Stackurity Research Team
- Tags: Actively Exploited, News

**TL;DR:** Cisco has patched CVE-2026-76418 in its ASA and FTD firewall software, and CISA lists it as exploited. It can crash a firewall through the VPN service. Stackurity does not cover firewall appliance firmware, so use Cisco's advisory for this one.

## What happened

The Hacker News [reported](https://thehackernews.com/2026/10/cisco-patches-actively-exploited-asa.html) that Cisco released patches for a high severity bug in the ASA and FTD firewall products, and said attackers have used it in the wild. On October 29, 2026 CISA added [CVE-2026-76418](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search%5Fapi%5Ffulltext=CVE-2026-76418) to its Known Exploited Vulnerabilities catalogue, with a due date of November 1, 2026.

The [National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-76418) shows a CVSS v3.1 score of 8.6 from Cisco and classes the weakness as CWE-690\. Without logging in, an attacker can send a crafted request to the remote access SSL VPN service, and a logic error that appears when secondary authentication is set on a tunnel group makes the device reload. The result is a denial of service, not code execution.

The data we hold gives no list of fixed versions, so take them from Cisco's advisory.

## Am I affected?

You are a candidate if you run ASA or FTD with the remote access SSL VPN service enabled and secondary authentication configured on a tunnel group. Confirm in Cisco's advisory, apply the fixed release it names, and treat any unexplained firewall reload as a possible sign of attack.

## How to check with Stackurity

Stackurity does not cover this product. It does not cover network appliance firmware such as firewalls and VPN gateways, so it will not find or rank this flaw. Track it with Cisco's advisory and your network team's own tooling. For the Linux servers, images and repositories behind the firewall, [start a free trial](https://app.stackurity.dev/signup?utm%5Fsource=blog&utm%5Fmedium=referral&utm%5Fcampaign=actively-exploited&utm%5Fcontent=cisco-asa-ftd-cve-2026-76418-exploited-vpn-dos), or read [how Stackurity protects your data](https://stackurity.dev/security.html).