Cisco has patched CVE-2026-76418, an actively exploited zero-day that lets an unauthenticated remote attacker crash Secure Firewall ASA and Threat Defense (FTD) devices running the SSL VPN. CISA added the flaw, along with a critical GitLab remote code execution bug, to its Known Exploited Vulnerabilities catalog on October 29.
CVE-2026-76418 Lets Attackers Reload Cisco Firewalls
Cisco published its advisory and patches on October 28. The flaw, rated CVSS 8.6, causes the device to reload, producing a denial of service. The root cause is a set of logic errors that arise when secondary authentication is configured on a tunnel group. An attacker sends a crafted request while connecting to the SSL remote access VPN.
Cisco PSIRT became aware of exploitation in October 2026. The company has not said who is behind the attacks or how many targets are affected, and it has not published indicators of compromise.
Which ASA and FTD Configurations Are Exposed
Exposed devices have webvpn, the SSL VPN feature, enabled with secondary-authentication-server-group set on a tunnel group. That includes the default DefaultWEBVPNGroup. Cisco lists no full workaround. The interim mitigation is disabling secondary authentication on affected tunnel groups.
Remote firewall crashes can cut VPN access for the organizations that depend on these devices. The scale of the impact is unknown.
CISA Adds the Cisco Flaw and GitLab CVE-2026-97229 to KEV
On Thursday, October 29, CISA added CVE-2026-76418 and GitLab CVE-2026-97229, which carries a CVSS score of 10.0, to the KEV catalog. Federal agencies must apply patches by November 1, 2026.
The KEV listing for the GitLab flaw follows earlier coverage of its public exploit.
Alpine Linux Reports Probing of Its GitLab Server
The GitLab flaw’s real-world use surfaced in a disclosure from Alpine Linux on October 28. Alpine said an attacker probed its own GitLab server on October 20-21 and again on October 25-26 through CVE-2026-97229, crashing worker processes eight times.
Alpine found no evidence that the attacker succeeded. It nonetheless rebuilt the server and reset every password. The project said its aports repository, its packages and its October 21 releases were not tampered with.
Why Upgrading GitLab to 19.3.6 Was Not Enough for Alpine
Alpine reported that upgrading GitLab alone, to version 19.3.6, was not sufficient on its custom Ruby setup. Fixed Ruby builds are 3.3.13, 3.4.12 and 4.0.9. The detail matters for self-hosted GitLab operators who compile or pin their own Ruby version, since the GitLab package upgrade by itself did not close the exposure Alpine saw.
Federal Deadline and Remaining Unknowns
CISA’s November 1 deadline gives federal civilian agencies only days to act on both flaws. For Cisco, administrators are directed to upgrade to the fixed ASA and FTD releases listed in Cisco’s advisory. For GitLab, the response combines the GitLab fix with the corrected Ruby builds.
Several facts remain unknown on the Cisco side: the identity of the attackers, the number of targeted devices, and whether the exploitation has been limited to disruption or has served other aims. Cisco’s statement that it learned of exploitation in October, without a more specific date, leaves the start of the activity unclear. Together, the two KEV additions place a network-edge denial-of-service flaw and a perfect-score source-control flaw on the same federal remediation clock.
Cisco’s Disclosure Leaves Exploitation Details Unpublished
Cisco’s advisory names the affected feature set but withholds the details that would help others look for attacks. The company has not identified the attacker, given the number of targeted devices or released indicators of compromise. It said only that PSIRT became aware of exploitation in October 2026.
The attack requires no credentials: a crafted request sent while connecting to the SSL remote access VPN is enough to trigger a reload on a device in the exposed configuration. The CVSS 8.6 rating reflects a flaw that disrupts availability rather than granting access, so the exploitation Cisco describes concerns crashing VPN devices and cutting off remote access until the firewall recovers.
