Page generated: 06 Nov 2026, 03:49 UTC
← Dashboard

CVE-2026-76418

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting i…

Read full description
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
CVSS 8.6 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
5.7/10
REALITY · THREAT PRIORITY
8.3/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 8.6: +1.29
  • Fresh EPSS: 0.82%: +0.00

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 26 documents and public datasets.

Hype components

Headline sample (25%)
10/100
Press, 30 days (60%)
90/100
Grounded branding (15%)
0/100
HYPE TOTAL56/100

Sources and documents

NeoTeo
Press · 01 Nov 2026, 05:55 · Cisco CVE-2026-76418: exposure and fixed releases - NeoTeo
NeoTeo
Press · 01 Nov 2026, 00:48 · Cisco CVE-2026-76418 Patch: ASA and FTD Fixes - NeoTeo
Security Affairs
Press · 30 Oct 2026, 20:25 · U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog
SecNews.gr
Press · 30 Oct 2026, 10:46 · CISA KEV: GitLab and Cisco vulnerabilities actively exploited - SecNews.gr
Rescana
Press · 30 Oct 2026, 07:37 · Cisco Secure Firewall ASA and FTD CVE-2026-76418: Exploited SSL VPN DoS Flaw Added to CISA KEV - Rescana
See all 26 source documents
The Hacker News
Press · 30 Oct 2026, 07:27 · CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV - The Hacker News
https://tech-insider.org/
Press · 30 Oct 2026, 03:37 · CVE-2026-76418: Cisco ASA/FTD Zero-Day, CVSS 8.6 [2026] - https://tech-insider.org/
CSO Online
Press · 29 Oct 2026, 19:31 · New Cisco firewall zero-day being actively exploited
Help Net Security
Press · 29 Oct 2026, 16:25 · Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls - Help Net Security
"CVE-2026-76418" - Google News
Press · 29 Oct 2026, 13:41 · Cisco fixes exploited VPN flaw in ASA and FTD - SecNews.gr
SOC Prime
Press · 29 Oct 2026, 13:11 · CVE-2026-76418: Cisco Secure Firewall Zero-Day Exploited in SSL VPN Attacks - SOC Prime
BleepingComputer
Press · 29 Oct 2026, 11:10 · New Cisco firewall zero-day exploited to crash SSL VPN devices - BleepingComputer
The Hacker News
Press · 29 Oct 2026, 10:44 · Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
The Hacker News
Press · 29 Oct 2026, 10:44 · Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls - The Hacker News
Avisos INCIBE-CERT
Press · 29 Oct 2026, 08:53 · [Actualización 30/10/2026] Múltiples vulnerabilidades en productos de Cisco
CERT-FR
Technical advisory · 29 Oct 2026, 00:00 · Vulnérabilité dans les produits Cisco (29 octobre 2026)
Cisco Security Advisory
Technical advisory · 28 Oct 2026, 19:15 · Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
Cisco Security Advisory
Press · 28 Oct 2026, 19:15 · Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
CCB Belgium
Press · 28 Oct 2026, 07:00 · Warning: Unauthenticated Remote Denial of Service in Cisco Secure Firewall ASA and FTD Software, Patch Immediately! - CCB Belgium
"CVE-2026-76418" - Google News
Press · 21 Oct 2026, 07:00 · CVE-2026-109618 & CVE-2026-109619: PHP RCE Flaws - SOC Prime
"CVE-2026-76418" - Google News
Press · 06 Oct 2026, 07:00 · CVE-2026-21589: Critical Atlassian File Access Flaw - SOC Prime
"CVE-2026-76418" - Google News
Press · 17 Sep 2026, 07:00 · CVE-2026-76460: Cisco ISE Zero-Day Exploited - SOC Prime
"CVE-2026-76418" - Google News
Press · 15 Sep 2026, 07:00 · CVE-2026-76461: Critical Cisco Secure Email Gateway Zero-Day Enables Root RCE - SOC Prime
SOC Prime
Press · 12 Aug 2026, 07:00 · CVE-2026-68820: Actively Exploited Windows AFD.sys Zero-Day Enables SYSTEM Privilege Escalation - SOC Prime
SOC Prime
Press · 30 Jul 2026, 07:00 · CVE-2026-47876: Critical VMware ESXi VM Escape Flaw Enables Host Code Execution - SOC Prime
SOC Prime
Press · 23 Apr 2026, 07:00 · CVE-2026-40372: ASP.NET Core Privilege Escalation - SOC Prime

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

024681002 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 5.6Reality 8.302 Nov 2026 · HIGH ATTENTION + OBSERVED EXPLOITATIONHype 6.2Reality 8.302 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 6.0Reality 8.306 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 5.7Reality 8.3Nov 2Nov 2Nov 2Nov 6

━ Hype Score (Perceived)  ━ Reality threat priority. Definition changes are not new attacks.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 8.6; EPSS 0.8%
Attention, last 30 days
18 distinct story titles; 18 press documents; 6 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-06 00:12:49.640935+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
23 Apr 2026, 07:00
Published
28 Oct 2026, 20:05
Added to the CISA KEV catalog
29 Oct 2026, 00:00
Latest press mention
01 Nov 2026, 05:55
Score calculated
06 Nov 2026, 00:12