Cisco warns of actively exploited ASA and FTD VPN flaw CVE-2026-76418
ZERO-DAYCVE-2026-76418redteam/daily · 4 sources
- Severity
- High
- Highest CVSS
- 10.0
- Exploited
- Yes
- Sources
- 4
What happened
Cisco has patched CVE-2026-76418, a high-severity flaw (CVSS 8.6) in the remote access SSL VPN of Secure Firewall ASA and Threat Defense (FTD). An unauthenticated remote attacker can send a crafted request that forces a device reload, causing denial of service. The flaw is being exploited in the wild and has been added to CISA's KEV catalogue, with federal agencies required to remediate by 1 November 2026. Cisco urges immediate updating and offers a temporary mitigation of disabling secondary authentication on the tunnel group list or DefaultWEBVPNGroup.
For IT people · Written by AI from 4 sources · Wrong?
What to do
- Update Gitlab to the fixed version for your release line (fixes CVE-2026-97229): 19.2.8, 19.3.5 or 19.4.2.
- Update Ruby-lang Ruby to the fixed version for your release line (fixes CVE-2026-97229): 3.3.13, 3.4.12 or 4.0.8.
- CVE-2026-97229 is being exploited: treat it as urgent.
- Check whether you use Gitlab: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
- CVE-2026-97229CVSS 10.0ExploitedGitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expressi
- CVE-2026-76418CVSS 8.6ExploitedA vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of servic
Full story timeline · 9 updates
- Tue 13 OctoberCVE-2026-97229 published, CVSS 10.0NVD
- Wed 21 OctoberCisco security advisory (AV26-1073)Canadian Centre for Cyber Security
- Wed 28 OctoberCVE-2026-76418 published, CVSS 8.6NVD
- Thu 29 OctoberCVE-2026-97229 added to CISA’s exploited listCISA KEV
- CVE-2026-76418 added to CISA’s exploited listCISA KEV
- Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash FirewallsThe Hacker News
- Cisco security advisory (AV26-1102)Canadian Centre for Cyber Security
- New Cisco firewall zero-day being actively exploitedCSO Online
- Fri 30 OctoberU.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs
Who reported · 4 outlets
Canadian Centre for Cyber SecurityThe Hacker NewsCSO OnlineSecurity Affairs
Who and what is in it
Companies
Products