CVE-2026-76418high8.6 Known exploited

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

Impact

A vulnerability in Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software could allow an unauthenticated, remote attacker to cause a denial of service condition. The vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this by sending a crafted request when connecting to the SSL remote access VPN.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

Cisco · cisco

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software

142 ranges

cisco version evidence

Check a product version

Compare with this publisher’s ranges. This does not inspect your installation.

affected

9.16.1

9.16.1.28

9.16.2

9.16.2.3

9.16.2.7

9.16.2.11

9.16.2.13

9.16.2.14

9.16.3.3

9.16.3

9.16.3.14

9.18.1

9.16.3.15

9.18.1.3

9.18.2

9.16.3.19

9.16.3.23

9.18.2.5

9.16.4

9.18.2.7

9.19.1

9.16.4.9

9.18.2.8

9.16.4.14

9.18.3

9.19.1.5

9.16.4.18

9.19.1.9

9.18.3.39

9.16.4.19

9.19.1.12

9.18.3.46

9.16.4.27

9.19.1.18

9.18.3.53

9.18.3.55

9.16.4.38

9.16.4.39

9.18.3.56

9.20.1

9.16.4.42

9.19.1.22

9.18.4

9.20.1.5

9.18.4.5

9.19.1.24

9.16.4.48

9.18.4.8

9.20.2

9.19.1.27

9.16.4.55

9.18.4.22

9.20.2.10

9.16.4.57

9.19.1.28

9.18.4.24

9.20.2.21

9.16.4.61

9.19.1.31

9.18.4.29

9.20.2.22

9.16.4.62

9.18.4.34

9.20.3

9.16.4.67

9.16.4.70

9.18.4.40

9.23.1

9.22.1.1

9.16.4.71

9.20.3.4

9.18.4.47

9.20.3.7

9.19.1.37

9.16.4.76

9.20.3.9

9.19.1.38

9.18.4.50

9.22.1.3

9.20.3.10

9.22.1.2

9.18.4.52

9.20.3.13

9.22.1.6

9.18.4.53

9.16.4.82

9.22.2

9.20.3.16

9.19.1.42

9.18.4.57

9.16.4.84

9.23.1.3

9.20.3.20

9.22.2.4

9.23.1.7

9.20.4

9.22.2.9

9.23.1.13

9.20.4.7

9.22.2.13

9.18.4.66

9.20.4.10

9.23.1.19

9.16.4.85

9.22.2.14

9.18.4.67

9.24.1

9.18.4.68

9.23.1.22

9.20.4.14

9.22.2.20

9.18.4.71

9.20.4.19

9.23.1.26

9.16.4.89

9.22.2.32

9.18.4.76

9.22.3

9.24.1.5

9.20.4.22

9.24.1.9

9.20.4.28

9.22.3.5

9.16.4.92

9.18.4.135

9.23.1.195

9.20.4.30

9.24.1.155

9.23.1.32

9.24.1.11

9.20.4.34

9.18.4.82

9.24.10

9.18.4.90

9.20.4.46

9.20.4.235

9.20.4.49

9.22.3.26

9.16.4.103

9.18.4.94

9.23.1.47

9.24.1.26

Other versions: unknown

Cisco · cisco

Cisco Secure Firewall Threat Defense (FTD) Software

67 ranges

cisco version evidence

Check a product version

Compare with this publisher’s ranges. This does not inspect your installation.

affected

7.0.0

7.0.0.1

7.0.1

7.0.1.1

7.0.2

7.2.0

7.0.2.1

7.0.3

7.2.0.1

7.0.4

7.2.1

7.0.5

7.3.0

7.2.2

7.2.3

7.3.1

7.2.4

7.0.6

7.2.5

7.2.4.1

7.3.1.1

7.4.0

7.0.6.1

7.2.5.1

7.4.1

7.2.6

7.0.6.2

7.4.1.1

7.2.7

7.2.5.2

7.3.1.2

7.2.8

7.6.0

7.4.2

7.2.8.1

7.0.6.3

7.4.2.1

7.2.9

7.0.7

7.7.0

7.4.2.2

7.2.10

7.6.1

7.4.2.3

7.0.8

7.6.2

7.7.10

7.7.11

7.0.8.1

7.6.2.1

7.7.10.1

7.4.2.4

7.2.10.2

7.4.3

7.6.4

10.0.0

7.4.4

7.0.9

7.2.11

7.4.7

7.4.8

7.2.12

7.6.6

7.7.13

10.0.2

7.0.10

10.1.0

Other versions: unknown

Original source description

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

Inside the record

Evidence available

Package identity · not supplied

Version evidence

Remediation guidance · not supplied

Weakness classification

Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-76418

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-690 ↗

Unchecked Return Value to NULL Pointer Dereference

cisco

Contributing organizations · 2

cisco

Assigning organization

2026-10-28

CISA-ADP

Additional data publisher

2026-10-30

What changed

Follow changes

CVE · CVE-2026-764182026-10-30

Observed 2026-10-30T04:20:30.401Z · upstream updated 2026-10-30T03:55:57.976Z

Prioritization updated

before

[
  {
    "source": "CISA-ADP",
    "type": "SSVC",
    "role": "CISA Coordinator",
    "timestamp": "2026-10-29T19:50:11.066278Z",
    "decisions": [
      {
        "name": "Exploitation",
        "value": "active"
      },
      {
        "name": "Automatable",
        "value": "yes"
      },
      {
        "name": "Technical Impact",
        "value": "partial"
      }
    ]
  }
]

after

[
  {
    "source": "CISA-ADP",
    "type": "SSVC",
    "role": "CISA Coordinator",
    "timestamp": "2026-10-28T00:00:00+00:00",
    "decisions": [
      {
        "name": "Exploitation",
        "value": "active"
      },
      {
        "name": "Automatable",
        "value": "yes"
      },
      {
        "name": "Technical Impact",
        "value": "partial"
      }
    ]
  }
]

CVE · CVE-2026-764182026-10-29

Observed 2026-10-29T20:45:37.571Z · upstream updated 2026-10-29T19:58:23.878Z

References changed

before

[
  "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75"
]

after

[
  "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75",
  "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76418"
]

Prioritization updated

before

[
  {
    "source": "CISA-ADP",
    "type": "SSVC",
    "role": "CISA Coordinator",
    "timestamp": "2026-10-28T00:00:00+00:00",
    "decisions": [
      {
        "name": "Exploitation",
        "value": "none"
      },
      {
        "name": "Automatable",
        "value": "yes"
      },
      {
        "name": "Technical Impact",
        "value": "partial"
      }
    ]
  }
]

after

[
  {
    "source": "CISA-ADP",
    "type": "SSVC",
    "role": "CISA Coordinator",
    "timestamp": "2026-10-29T19:50:11.066278Z",
    "decisions": [
      {
        "name": "Exploitation",
        "value": "active"
      },
      {
        "name": "Automatable",
        "value": "yes"
      },
      {
        "name": "Technical Impact",
        "value": "partial"
      }
    ]
  }
]

Large field values are marked as truncated previews. Original source snapshots remain retained.

Showing up to 50 most recent observed changes.

References

2 sources

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75

Security advisorycisco

www.cisa.gov/known-exploited-vulnerabilities-catalog

government-resourceCISA-ADP

Priority and evidence

Known exploitedNo package fix recorded

KEV checked 31/10/2026, 15:15:33 UTCAdded 2026-10-29

CISA remediation guidance

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

cisco · CVSS:3.1 · 8.6

Assessment vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Reading the signals

Severity · CVSS: Technical impact and attack conditions. The headline is the highest imported catalog score; sources may disagree.
Observed exploitation · KEV: CISA lists this vulnerability as known exploited.
Predicted exploitation · EPSS: No EPSS estimate available in this record.

CISA-ADP · SSVC

CISA Coordinator · 2026-10-28

Exploitation: active
Automatable: yes
Technical Impact: partial

SSVC describes the publisher’s decision context. Your organization’s exposure and priorities may differ.

Record details

Published: 28/10/2026, 20:05:31 UTC
Modified: 30/10/2026, 03:55:57 UTC
Last imported by cve.new: 30/10/2026, 04:20:30 UTC
Aliases: None recorded

Source evidence

Request a correction or dispute

Start with the assigning organization for this record. Include the CVE ID, the disputed information, and supporting evidence. A dispute does not itself reject a record.

Find the responsible CNA →Official dispute and escalation process ↗

CVE CVE-2026-76418

Enrichment coverage

NVDAvailable

Checked 28/10/2026, 23:15:32 UTC

GHSAAvailable

Checked 28/10/2026, 23:15:32 UTC

EUVDAvailable

Checked 28/10/2026, 23:15:31 UTC

EPSSNo result

Checked 28/10/2026, 23:15:32 UTC

Additional source evidence

ENISA EUVD · EUVD-2026-112462

CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Checked 28/10/2026, 23:15:31 UTC

NVD · CVE-2026-76418

CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Checked 28/10/2026, 23:15:32 UTC

GitHub Advisory Database · GHSA-3whv-82g3-5cwx

CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Checked 28/10/2026, 23:15:32 UTC

Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.View as JSON

Investigate in your agent.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

Impact

Affected packages

Affected products

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software

affected

unaffected

unknown

Cisco Secure Firewall Threat Defense (FTD) Software

affected

unaffected

unknown

Original source description

Inside the record

Evidence available

Original records

Underlying weaknesses

What changed

References