Cisco ASA and FTD: exploited remote DoS, CVE-2026-76418

📌 Later developments: Cisco ASA/FTD CVE-2026-76418: who is exposed, how to mitigate (October 29, 2026)

On 29 October 2026 CERT-FR, the incident response centre of the French agency ANSSI, published advisory CERTFR-2026-AVI-1412 on a vulnerability in Cisco Secure Firewall ASA Software and Secure FTD Software, tracked as CVE-2026-76418. According to the advisory, the vulnerability allows an attacker to cause a remote denial of service (DoS), and Cisco states that it is being actively exploited.

This article is based on a single source, the CERT-FR advisory, which in turn refers to Cisco security advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 of 28 October 2026. Every piece of information below is attributed to the French agency; where the advisory gives no details, we say so.

What the advisory says

The CERT-FR advisory is short and limited to four elements:

• Risk: remote denial of service.
• Products: Cisco Secure Firewall ASA Software and Secure FTD Software, with the list of affected versions given below.
• Exploitation: according to Cisco, CVE-2026-76418 is being actively exploited.
• Solution: apply the fixes listed in Cisco’s security advisory.

The advisory does not describe the attack vector, the component involved, the required configuration conditions, the CVSS score, any workarounds or indicators of compromise, and it does not say whether the attacker needs to be authenticated. For all of these, the reference is Cisco’s advisory.

Affected versions

According to CERT-FR, the following versions are affected (faithful translation of the advisory’s list, version numbers copied unchanged).

Cisco Secure Firewall ASA Software

• versions 9.16 and earlier than 9.16.4.104
• versions 9.18.x earlier than 9.18.4.96
• versions 9.20.x earlier than 9.20.4.50
• versions 9.22.x earlier than 9.22.3.200
• versions 9.23.x earlier than 9.23.1.48
• versions 9.24.x earlier than “9.24.1.279.24.10.1” (see the note)

Cisco Secure FTD Software

• versions 10.0.x and earlier than 10.0.3
• versions 10.1.x and earlier than 10.1.1
• versions 7.0 and earlier than 7.0.11
• versions 7.2.x and earlier than 7.2.13
• versions 7.4.x and earlier than 7.4.9
• versions 7.6.x and earlier than 7.6.7
• versions 7.7.x and earlier than 7.7.14

Note on the ASA 9.24 train. In the advisory, the reference version for the 9.24 train appears as “9.24.1.279.24.10.1”, a value that does not have the usual format of ASA version numbers. The advisory does not make it possible to tell which version is correct: check it in Cisco’s advisory before planning the update.

Technical details

• CVE: CVE-2026-76418.
• Vendor advisory: Cisco cisco-sa-asaftd-tunnel-dos-s6mgkb75, dated 28 October 2026.
• National advisory: CERT-FR CERTFR-2026-AVI-1412, first version of 29 October 2026.
• Impact: remotely triggered denial of service, i.e. loss of availability of the affected device or service. The advisory does not mention any impact on confidentiality or integrity.
• Exploitation: active, according to Cisco as reported by CERT-FR. The advisory gives no details on the observed attacks, the attackers or the victims.
• MITRE ATT&CK: a denial of service achieved by exploiting a software vulnerability falls under technique T1499.004 (Endpoint Denial of Service: Application or System Exploitation).
• Indicators of compromise: none in the advisory.

Impact for European and Italian companies

A firewall is by nature a perimeter device: if it stops working, connectivity and the services that pass through it can go down together. The fact that, according to Cisco, the vulnerability is already being exploited makes the update a priority, not something to postpone to the next routine maintenance window. The advisory does not say how long the resulting outage lasts or whether the attack can be repeated.

For NIS2 entities, an exploited vulnerability on a perimeter device falls under vulnerability management, with documented priorities and timelines, and under business continuity. If the firewall is managed by a provider, the check must be done together with them. A significant outage caused by an attack must be assessed for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN. In healthcare, where wards, sites and suppliers depend on the network, an unavailable firewall can make clinical services unreachable: here too the update must be scheduled as a priority.

What to do now

1. Take an inventory of all devices running Cisco Secure Firewall ASA Software and Secure FTD Software, including those managed by providers, with the version of each one.
2. Compare the versions with the CERT-FR list and above all with Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75, which remains the reference for the fixed versions, especially for the 9.24 train.
3. Read Cisco’s advisory for the vulnerability conditions and any temporary mitigations: the French advisory does not include them.
4. Apply the fixes provided by Cisco, giving priority to devices reachable from the Internet, and plan for the reboot in the maintenance window.
5. Keep an eye on availability: check logs and monitoring for unexpected outages, reboots or hangs of the firewalls, and preserve the diagnostic information generated by the device before a manual reboot or an update.
6. If you find signs of an attack, handle it as a security incident, not just a vulnerability, and assess your notification obligations.

How ARXDOME helps

ARX Expose shows which services your company exposes on the Internet, the recognised products and their known vulnerabilities, so you know which firewalls can be reached from outside. ARX Sentry collects firewall logs in a central collector, so the event history remains available outside the device as well. ARX Radar analyses the traffic arriving at the firewall every minute and reports attacks under way against the perimeter.

Last updated: 29 October 2026