Cisco ASA/FTD VPN Flaw Actively Exploited, Patch Available

Thu, 29 Oct 2026 17:24:45 +0000

Engineer — Act: Cisco ASA and FTD are common enterprise perimeter devices; the vendor confirms active wild exploitation of this unauthenticated crash bug and a public PoC exists. Patch ASA/FTD software to Cisco’s fixed release immediately — these are your outermost network defenses.
SOC/IR — Plan: Active exploitation of perimeter VPN appliances warrants a new detection: alert on unexpected ASA/FTD process restarts or abnormal SSL VPN session drops that may signal crash-loop exploitation attempts against your edge devices.
Leader — Plan: Widely deployed Cisco perimeter firewalls being actively exploited is a material perimeter-risk event; confirm with your engineering team this week that affected ASA/FTD devices are inventoried and patching is scheduled.
Signals: CVE-2026-76418 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub

Cisco-Asa-Ftd on CuraSec