Cisco warns of actively exploited ASA and FTD VPN flaw CVE-2026-76418
- Severity
- High
- Highest CVSS
- 10.0
- Exploited
- Yes
- Sources
- 4
What happened
CVE-2026-76418 (CVSS 8.6) is a NULL pointer dereference, caused by logic errors when secondary authentication is configured on a tunnel group, in the Remote Access SSL VPN of Cisco Secure Firewall ASA and FTD. Unauthenticated remote attackers can force a reload and denial of service, and Cisco says it is exploited in the wild. Vulnerable configurations include the webvpn keyword with SSL VPN enabled on an interface, plus secondary-authentication-server-group on any tunnel group or DefaultWEBVPNGroup. Fixed releases: ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.4 (CSO lists 9.23.1.48), 9.24.1.27, 9.24.10.1; FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1. Defenders should patch now, or disable secondary authentication as a mitigation, and check tunnel-group-list and DefaultWEBVPNGroup settings. Cisco has not disclosed the attackers.
For security analysts · Written by AI from 4 sources · Wrong?
What to do
- Update Gitlab to the fixed version for your release line (fixes CVE-2026-97229): 19.2.8, 19.3.5 or 19.4.2.
- Update Ruby-lang Ruby to the fixed version for your release line (fixes CVE-2026-97229): 3.3.13, 3.4.12 or 4.0.8.
- CVE-2026-97229 is being exploited: treat it as urgent.
- Check whether you use Gitlab: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
- CVE-2026-97229CVSS 10.0ExploitedGitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expressi
- CVE-2026-76418CVSS 8.6ExploitedA vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of servic
Full story timeline · 9 updates
- Tue 13 OctoberCVE-2026-97229 published, CVSS 10.0NVD
- Wed 21 OctoberCisco security advisory (AV26-1073)Canadian Centre for Cyber Security
- Wed 28 OctoberCVE-2026-76418 published, CVSS 8.6NVD
- Thu 29 OctoberCVE-2026-97229 added to CISA’s exploited listCISA KEV
- CVE-2026-76418 added to CISA’s exploited listCISA KEV
- Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash FirewallsThe Hacker News
- Cisco security advisory (AV26-1102)Canadian Centre for Cyber Security
- New Cisco firewall zero-day being actively exploitedCSO Online
- Fri 30 OctoberU.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs
Who reported · 4 outlets
Who and what is in it
Companies
Products