CVE-2026-76418
waiting for further signalsZero needs more public information before it can validate it.GHSA-3whv-82g3-5cwx ↗EUVD-2026-112462 ↗
no check availablenot proven exploitable
cve.orgpublic pocExploit code has been published by someone. Source signals can also carry a PoC (Proof of Concept).kevAttacks confirmed in the real world.0d
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.1; 9.16.1.28; 9.16.2; 9.16.2.3; 9.16.2.7; 9.16.2.11; 9.16.2.13; 9.16.2.14; 9.16.3.3; 9.16.3; 9.16.3.14; 9.18.1; 9.16.3.15; 9.18.1.3; 9.18.2; 9.16.3.19; 9.16.3.23; 9.18.2.5; 9.16.4; 9.18.2.7; 9.19.1; 9.16.4.9; 9.18.2.8; 9.16.4.14; 9.18.3; 9.19.1.5; 9.16.4.18; 9.19.1.9; 9.18.3.39; 9.16.4.19; 9.19.1.12; 9.18.3.46; 9.16.4.27; 9.19.1.18; 9.18.3.53; 9.18.3.55; 9.16.4.38; 9.16.4.39; 9.18.3.56; 9.20.1; 9.16.4.42; 9.19.1.22; 9.18.4; 9.20.1.5; 9.18.4.5; 9.19.1.24; 9.16.4.48; 9.18.4.8; 9.20.2; 9.19.1.27; 9.16.4.55; 9.18.4.22; 9.20.2.10; 9.16.4.57; 9.19.1.28; 9.18.4.24; 9.20.2.21; 9.16.4.61; 9.19.1.31; 9.18.4.29; 9.20.2.22; 9.16.4.62; 9.18.4.34; 9.20.3; 9.16.4.67; 9.16.4.70; 9.18.4.40; 9.23.1; 9.22.1.1; 9.16.4.71; 9.20.3.4; 9.18.4.47; 9.20.3.7; 9.19.1.37; 9.16.4.76; 9.20.3.9; 9.19.1.38; 9.18.4.50; 9.22.1.3; 9.20.3.10; 9.22.1.2; 9.18.4.52; 9.20.3.13; 9.22.1.6; 9.18.4.53; 9.16.4.82; 9.22.2; 9.20.3.16; 9.19.1.42; 9.18.4.57; 9.16.4.84; 9.23.1.3; 9.20.3.20; 9.22.2.4; 9.23.1.7; 9.20.4; 9.22.2.9; 9.23.1.13; 9.20.4.7; 9.22.2.13; 9.18.4.66; 9.20.4.10; 9.23.1.19; 9.16.4.85; 9.22.2.14; 9.18.4.67; 9.24.1; 9.18.4.68; 9.23.1.22; 9.20.4.14; 9.22.2.20; 9.18.4.71; 9.20.4.19; 9.23.1.26; 9.16.4.89; 9.22.2.32; 9.18.4.76; 9.22.3; 9.24.1.5; 9.20.4.22; 9.24.1.9; 9.20.4.28; 9.22.3.5; 9.16.4.92; 9.18.4.135; 9.23.1.195; 9.20.4.30; 9.24.1.155; 9.23.1.32; 9.24.1.11; 9.20.4.34; 9.18.4.82; 9.24.10; 9.18.4.90; 9.20.4.46; 9.20.4.235; 9.20.4.49; 9.22.3.26; 9.16.4.103; 9.18.4.94; 9.23.1.47; 9.24.1.26; 7.0.0; 7.0.0.1; 7.0.1; 7.0.1.1; 7.0.2; 7.2.0; 7.0.2.1; 7.0.3; 7.2.0.1; 7.0.4; 7.2.1; 7.0.5; 7.3.0; 7.2.2; 7.2.3; 7.3.1; 7.2.4; 7.0.6; 7.2.5; 7.2.4.1; 7.3.1.1; 7.4.0; 7.0.6.1; 7.2.5.1; 7.4.1; 7.2.6; 7.0.6.2; 7.4.1.1; 7.2.7; 7.2.5.2; 7.3.1.2; 7.2.8; 7.6.0; 7.4.2; 7.2.8.1; 7.0.6.3; 7.4.2.1; 7.2.9; 7.0.7; 7.7.0; 7.4.2.2; 7.2.10; 7.6.1; 7.4.2.3; 7.0.8; 7.6.2; 7.7.10; 7.7.11; 7.0.8.1; 7.6.2.1; 7.7.10.1; 7.4.2.4; 7.2.10.2; 7.4.3; 7.6.4; 10.0.0; 7.4.4; 7.0.9; 7.2.11; 7.4.7; 7.4.8; 7.2.12; 7.6.6; 7.7.13; 10.0.2; 7.0.10; 10.1.0
ETK-2026-2963Zero's internal tracking ID, independent of the CVE number., permanent identifier
3h 03msince last run
13mAI analysisAnalysis: how long the AI spent reversing this signal.
description
Cisco Secure Firewall ASA and FTD Remote Access SSL VPN services are affected by a logic error that can force a device reload. An unauthenticated remote attacker may cause denial of service when secondary authentication is configured on a VPN tunnel group.
mitigation
Apply Cisco's security update when a vendor-supported fixed release is identified for your deployment. Until then, reduce exposure by disabling Remote Access SSL VPN or secondary authentication on affected tunnel groups where operationally feasible.
check
no
exploit
no
automationDeterministic: a check that runs on its own, the same request on every target. Contextual: an agentic technique that needs to be applied per target, for bugs that depend on contextual flows.
contextual
auth requiredWhether an attacker needs an account first, based on the CVSS vector's Privileges Required.
no
EPSSEstimate of the chance this CVE is exploited in the next 30 days. Refreshed daily.
–
agent run time
13m
cve.org record, t = 0The moment cve.org publishes the CVE in full.
2026-10-28 20:05Z
Δ to public pocExploit code has been published by someone. Source signals can also carry a PoC (Proof of Concept).
–
Δ to kevAttacks confirmed in the real world.
0d
outcome
Contextual, not validated: no deterministic check could cover this one, and no technique passed our review.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-28 00:00Z
- 2026-10-28 20:05Zbleepingcomputer: trigger signal, started the run
- 2026-10-28 20:05Zcve.org record for CVE-2026-76418
this entry in the feed
GET /api/v1/feed/CVE-2026-76418
{ "etk_id": "ETK-2026-2963", "cve_id": "CVE-2026-76418", "display_id": "CVE-2026-76418", "ghsa_id": "GHSA-3whv-82g3-5cwx", "euvd_id": "EUVD-2026-112462", "status": "published", "anchor_state": "anchored", "title": "Remote Access SSL VPN denial of service in Cisco Secure Firewall", "summary": "Cisco Secure Firewall ASA and FTD Remote Access SSL VPN services are affected by a logic error that can force a device reload. An unauthenticated remote attacker may cause denial of service when secondary authentication is configured on a VPN tunnel group.", "mitigation": "Apply Cisco's security update when a vendor-supported fixed release is identified for your deployment. Until then, reduce exposure by disabling Remote Access SSL VPN or secondary authentication on affected tunnel groups where operationally feasible.", "vendor": "Cisco", "product": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software", "affected": [ { "affected_notes": [], "affected_ranges": [ "9.16.1", "9.16.1.28", "9.16.2", "9.16.2.3", "9.16.2.7", "9.16.2.11", "9.16.2.13", "9.16.2.14", "9.16.3.3", "9.16.3", "9.16.3.14", "9.18.1", "9.16.3.15", "9.18.1.3", "9.18.2", "9.16.3.19", "9.16.3.23", "9.18.2.5", "9.16.4", "9.18.2.7", "9.19.1", "9.16.4.9", "9.18.2.8", "9.16.4.14", "9.18.3", "9.19.1.5", "9.16.4.18", "9.19.1.9", "9.18.3.39", "9.16.4.19", "9.19.1.12", "9.18.3.46", "9.16.4.27", "9.19.1.18", "9.18.3.53", "9.18.3.55", "9.16.4.38", "9.16.4.39", "9.18.3.56", "9.20.1", "9.16.4.42", "9.19.1.22", "9.18.4", "9.20.1.5", "9.18.4.5", "9.19.1.24", "9.16.4.48", "9.18.4.8", "9.20.2", "9.19.1.27", "9.16.4.55", "9.18.4.22", "9.20.2.10", "9.16.4.57", "9.19.1.28", "9.18.4.24", "9.20.2.21", "9.16.4.61", "9.19.1.31", "9.18.4.29", "9.20.2.22", "9.16.4.62", "9.18.4.34", "9.20.3", "9.16.4.67", "9.16.4.70", "9.18.4.40", "9.23.1", "9.22.1.1", "9.16.4.71", "9.20.3.4", "9.18.4.47", "9.20.3.7", "9.19.1.37", "9.16.4.76", "9.20.3.9", "9.19.1.38", "9.18.4.50", "9.22.1.3", "9.20.3.10", "9.22.1.2", "9.18.4.52", "9.20.3.13", "9.22.1.6", "9.18.4.53", "9.16.4.82", "9.22.2", "9.20.3.16", "9.19.1.42", "9.18.4.57", "9.16.4.84", "9.23.1.3", "9.20.3.20", "9.22.2.4", "9.23.1.7", "9.20.4", "9.22.2.9", "9.23.1.13", "9.20.4.7", "9.22.2.13", "9.18.4.66", "9.20.4.10", "9.23.1.19", "9.16.4.85", "9.22.2.14", "9.18.4.67", "9.24.1", "9.18.4.68", "9.23.1.22", "9.20.4.14", "9.22.2.20", "9.18.4.71", "9.20.4.19", "9.23.1.26", "9.16.4.89", "9.22.2.32", "9.18.4.76", "9.22.3", "9.24.1.5", "9.20.4.22", "9.24.1.9", "9.20.4.28", "9.22.3.5", "9.16.4.92", "9.18.4.135", "9.23.1.195", "9.20.4.30", "9.24.1.155", "9.23.1.32", "9.24.1.11", "9.20.4.34", "9.18.4.82", "9.24.10", "9.18.4.90", "9.20.4.46", "9.20.4.235", "9.20.4.49", "9.22.3.26", "9.16.4.103", "9.18.4.94", "9.23.1.47", "9.24.1.26" ], "ecosystem": null, "fixed_versions": [], "package_name": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software", "purl": null }, { "affected_notes": [], "affected_ranges": [ "7.0.0", "7.0.0.1", "7.0.1", "7.0.1.1", "7.0.2", "7.2.0", "7.0.2.1", "7.0.3", "7.2.0.1", "7.0.4", "7.2.1", "7.0.5", "7.3.0", "7.2.2", "7.2.3", "7.3.1", "7.2.4", "7.0.6", "7.2.5", "7.2.4.1", "7.3.1.1", "7.4.0", "7.0.6.1", "7.2.5.1", "7.4.1", "7.2.6", "7.0.6.2", "7.4.1.1", "7.2.7", "7.2.5.2", "7.3.1.2", "7.2.8", "7.6.0", "7.4.2", "7.2.8.1", "7.0.6.3", "7.4.2.1", "7.2.9", "7.0.7", "7.7.0", "7.4.2.2", "7.2.10", "7.6.1", "7.4.2.3", "7.0.8", "7.6.2", "7.7.10", "7.7.11", "7.0.8.1", "7.6.2.1", "7.7.10.1", "7.4.2.4", "7.2.10.2", "7.4.3", "7.6.4", "10.0.0", "7.4.4", "7.0.9", "7.2.11", "7.4.7", "7.4.8", "7.2.12", "7.6.6", "7.7.13", "10.0.2", "7.0.10", "10.1.0" ], "ecosystem": null, "fixed_versions": [], "package_name": "Cisco Secure Firewall Threat Defense (FTD) Software", "purl": null } ], "cwes": null, "cvss_score": 8.6, "cvss_src": "other", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "contextual", "check": false, "check_confidence_basis": null, "exploit": false, "pipeline_minutes": 13.326665733333334, "t0_at": "2026-10-28T20:05:31.926000+00:00", "signals": { "kev": { "at": "2026-10-28T00:00:00+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-28T20:05:31.926000+00:00", "precision": "day", "url": "https://vulncheck.com/cve/CVE-2026-76418" }, "trigger_signal": { "at": "2026-10-28T20:05:31.926000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-28T20:05:31.926000+00:00", "url": "https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/" } } }
published 2026-10-29 11:18Z
last change 2026-10-29 14:21Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.