Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Active Exploitation of Vulnerability in Cisco Adaptive Security Appliance Software and Cisco Secure Firewall Threat Defense

4 November 2026

Attackers are exploiting a high-severity vulnerability in Cisco Adaptive Security Appliance Software and Cisco Secure Firewall Threat Defense to trigger denial of service. Patch immediately.

Background

Cisco has released security updates to address a high-severity vulnerability (CVE-2026-76418) affecting Cisco Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD). This vulnerability has a Common Vulnerability Scoring System (CVSS v3.1) score of 8.6 out of 10.

Impact

Due to logic errors in the Remote Access SSL VPN service, when secondary authentication is configured for a tunnel group, an unauthenticated remote attacker could send a crafted request to the SSL remote access VPN service causing the affected device to reload unexpectedly. This would result in a denial of service condition.

Known Exploitation

Cisco has confirmed active exploitation of this vulnerability.

Affected Products

The vulnerability affects the following products:

  • Cisco ASA Software

    • Versions before 9.16.4.104

    • Versions 9.18.0 to before 9.18.4.96

    • Versions 9.20.0 to before 9.20.4.50

    • Versions 9.22.0 to before 9.22.3.200

    • Versions 9.23.0 to before 9.23.1.48

    • Versions 9.24.1 to before 9.24.1.27

    • Version 9.24.10

  • Cisco Secure FTD

    • Versions before 7.0.11

    • Versions 7.2.0 to before 7.2.13

    • Versions 7.3.0 to before 7.4.9

    • Versions 7.6.0 through 7.6.7

    • Versions 7.7.0 to before 7.7.14

    • Versions 10.0.0 to before 10.0.3

    • Version 10.1.0

Users and administrators should refer to the vendor advisory for the full list of affected versions.

Recommendations

Users and administrators of affected products are advised to update to the latest versions immediately.

References