CISA adds actively exploited Cisco firewall flaw to KEV catalogue

CISA added CVE-2026-76418 to its Known Exploited Vulnerabilities (KEV) catalogue on 29 October 2026. The vulnerability affects Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, and could let an unauthenticated remote attacker trigger an unexpected device reload and cause denial of service.

The flaw is an unchecked return value that can lead to a NULL pointer dereference. It has a CVSS score of 8.6, rated HIGH. The attack is remote and does not require authentication. The supplied data does not confirm whether a patch is available; organisations should consult Cisco’s security advisory for current vendor guidance.

CISA’s KEV listing indicates that the vulnerability is being actively exploited. The available data lists ransomware use as unknown. CISA set a remediation deadline of 1 November 2026.

CISA requires organisations to apply mitigations in accordance with Cisco’s instructions and relevant BOD 26-04 guidance, including its Forensics Triage Requirements. For cloud services, organisations should follow applicable BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Stakeholders must assess each asset’s internet exposure and comply with BOD 26-04 patching guidelines.

Federal Civilian Executive Branch (FCEB) agencies are directly subject to CISA’s required remediation, and all organisations should review their exposure and take appropriate action.

For full details, see the linked NVD entry and CISA KEV catalogue.