Vulnerabilities & Exploits

Cisco VPN flaw can restart firewalls during active exploitation

The Netherlands Cyber Security Centre (NCSC-NL) reported Oct. 30 that Cisco confirmed active exploitation of one flaw in Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) Software. The flaw affects the Remote Access Secure Sockets Layer (SSL) virtual private network (VPN) service and can force appliances to restart, disrupting service.

A crafted request makes the VPN service use a missing value, causing it to crash and restart. The service must be reachable, and secondary authentication must be configured for a VPN tunnel group; a successful VPN login is not required. The reported impact is denial of service, not evidence of account takeover or code execution.

If these appliances also protect other network traffic, a forced restart may disrupt that traffic as well. The advisory confirms service disruption but does not establish compromise beyond it.

1 source · 17h ago

CVE-2026-76418

NVD KEV

Published Oct 28 by Cisco Systems

Known exploited · CISA KEV

CVSS 8.6 HIGH: a vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA)…

CISA federal remediation date Nov 1

Timeline

Nov 1 CISA federal deadline for CVE-2026-76418
Oct 30 Reported by NCSC-NL Advisories
Oct 29 CVE-2026-76418 added to CISA KEV
Oct 28 CVE-2026-76418 published

Sources

Oct 30 NCSC-NL Advisories
Kwetsbaarheid verholpen in Cisco Secure Firewall ASA en FTD Software
Deze kwetsbaarheid met kenmerk CVE-2026-76418 heeft een CVSS-score van 8.6 en bevindt zich in de Remote Access SSL VPN-functionaliteit.
original

Vendor digest: Cisco

Part of the PlainSec briefing for 2026-10-31

Every edition of this story: Cisco VPN flaw can restart firewalls during active exploitation

More from today

Vulnerabilities & ExploitsCisco VPN flaw can restart firewalls during active exploitationThe Netherlands Cyber Security Centre (NCSC-NL) reported Oct. 30 that Cisco confirmed active exploitation of one flaw in Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) Software. The flaw affects the Remote Access Secure Sockets Layer (SSL) virtual private network (VPN) service and can force appliances to restart, disrupting service.A crafted request makes the VPN service use a missing value, causing it to crash and restart. The service must be reachable, and secondary authentication must be configured for a VPN tunnel group; a successful VPN login is not required. The reported impact is denial of service, not evidence of account takeover or code execution.If these appliances also protect other network traffic, a forced restart may disrupt that traffic as well. The advisory confirms service disruption but does not establish compromise beyond it.1 source · 17h ago