CISA puts Cisco SSL VPN DoS on the exploited list with a November 1 clock

CISA added CVE-2026-76418 to the Known Exploited Vulnerabilities catalog on October 29, 2026. The same bulletin that stamped GitLab’s max-severity CI bug also stamped this one. Federal civilian agencies have until November 1, 2026 under Binding Operational Directive 26-04. Private operators of Cisco Secure Firewall Adaptive Security Appliance and Threat Defense sit on the same edge devices and the same exploit clock.

Cisco scores the issue 8.6 under CVSS 3.1. The failure is in the Remote Access SSL VPN service. When secondary authentication is configured on a tunnel group, an unauthenticated remote party can send a request that makes the appliance reload. That is a denial of service on the box that is supposed to keep remote workers on the network. Availability is the impact. Confidentiality and integrity are not claimed in the public advisory. A VPN gateway that reboots on demand is still an outage, and an outage on the edge is how people invent shadow tunnels.

Who is actually exposed

Cisco’s advisory is specific. A device is in scope when three facts line up. It runs a vulnerable ASA or FTD release. SSL remote access VPN is enabled on at least one interface. Secondary authentication is configured in the tunnel-group scope, including on DefaultWEBVPNGroup and on profiles that do not appear in the login list. If any of those is false, this particular KEV entry is not your problem. If all three are true, the login page is the audience.

Cisco published fixed builds for the current trains. On ASA, the first fixed releases include 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1. On FTD, the first fixed releases include 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, and 10.1.1. Confirm the train you run against the advisory table. A nearby version string is not the check.

Mitigation is not a patch

Cisco says there is no workaround that removes the bug. There is a temporary mitigation: turn off secondary authentication on DefaultWEBVPNGroup and on any user-configured tunnel group that uses it, or disable the tunnel-group list when DefaultWEBVPNGroup itself is clean. That change lowers the authentication posture of the VPN. It buys time. It does not replace the fixed image.

Do not invent packet filters as a substitute. The public record does not bless a “block this signature and go home” plan. Install the fixed release Cisco names for your train. If you cannot upgrade before the federal date, apply the vendor mitigation and schedule the image. Treat an internet-facing SSL VPN that was vulnerable through late October as an availability incident waiting to become a reliability story in the postmortem.

What to do before November 1

Inventory every ASA and FTD that terminates SSL remote access VPN. Check for secondary authentication on every tunnel group, not only the ones users see. Upgrade to the fixed release, or apply Cisco’s mitigation and then upgrade. Watch for unexpected reloads and VPN flaps in the October window. A DoS on the concentrator is not a webshell, but it is a reason to confirm nothing else walked through while the box was recovering.

This desk will not describe the request shape, the null-pointer path, or how to reproduce the reload. Defenders need the version numbers, the secondary-auth check, and the KEV date. Attackers already have the rest. An edge VPN that can be knocked over without a login is not a feature. November 1 is the federal due date. The operational date is the day the concentrator is still reachable and still vulnerable.

This briefing relies on CISA’s Known Exploited Vulnerabilities catalog and Cisco’s security advisory. It does not include exploit procedures or proof-of-concept detail.