{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/secure-firewall-asa--9.16.4.104--9.18.4.96--9.20.4.50--9.22.3.200--9.23.1.48--9.24.1.27/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-76418"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Secure Firewall Adaptive Security Appliance (ASA)","Secure Firewall Threat Defense (FTD)","Secure Firewall Adaptive Security Appliance (ASA) Software","Secure Firewall Threat Defense (FTD) Software (\u003c 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1)","Secure Firewall Threat Defense","ASA","Secure Firewall ASA (\u003c 9.16.4.104, \u003c 9.18.4.96, \u003c 9.20.4.50, \u003c 9.22.3.200, \u003c 9.23.1.48, \u003c 9.24.1.27)","Secure Firewall Threat Defense (\u003c 7.0.11, \u003c 7.2.13, \u003c 7.4.9, \u003c 7.6.7, \u003c 7.7.14, \u003c 10.0.3, \u003c 10.1.1)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-76418","denial-of-service","cisco","vpn","network-security","high-confidence-source"],"_cs_type":"threat","_cs_vendors":["Cisco"],"content_html":"\u003cp\u003eCisco has released security patches for a high-severity vulnerability (CVE-2026-76418) affecting the Remote Access SSL VPN service in Cisco Secure Firewall ASA and FTD software. The flaw, which stems from logic errors when secondary authentication is configured on a tunnel group, can be exploited by an unauthenticated, remote attacker sending a crafted request. Successful exploitation causes the affected device to reload unexpectedly, resulting in a denial-of-service (DoS) condition. Cisco confirmed active exploitation of this vulnerability as of October 2026.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to trigger an unexpected device reload, resulting in a complete denial-of-service for the affected network appliance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately apply the available software patches for your version of Cisco Secure Firewall ASA or FTD.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not feasible, implement the recommended workarounds: disable the tunnel group list if 'DefaultWEBVPNGroup' does not use secondary authentication, or disable secondary authentication on any user-configured or default tunnel groups ('DefaultWEBVPNGroup').\u003c/li\u003e\n\u003cli\u003eReview the deployed remote access VPN policy and current device configuration via Cisco Secure FMC or FDM to identify active secondary authentication configurations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T18:42:02Z","date_published":"2026-10-29T10:03:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cisco-firewall-dos/","summary":"Cisco patched an actively exploited logic vulnerability (CVE-2026-76418) in the SSL VPN service of ASA and FTD software that allows unauthenticated attackers to trigger a device reload and denial-of-service condition.","title":"Cisco Secure Firewall ASA and FTD: Denial of Service via SSL VPN (CVE-2026-76418)","url":"https://feed.craftedsignal.io/briefs/2026-10-cisco-firewall-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Secure Firewall ASA (\u003c 9.16.4.104, \u003c 9.18.4.96, \u003c 9.20.4.50, \u003c 9.22.3.200, \u003c 9.23.1.48, \u003c 9.24.1.27)","version":"https://jsonfeed.org/version/1.1"}