Cisco Warns of Unauthenticated DoS Flaw in Secure Firewall ASA and FTD

Key points

• CVE-2026-76418 affects Cisco Secure Firewall ASA and Secure Firewall FTD.
• An attacker without credentials can trigger a denial of service by causing the appliance to reload.
• Exploitation is remote and requires no authentication, raising the risk for internet-facing devices.
• Cisco directs customers to apply available mitigations and patch in line with its guidance.

Cisco has disclosed a vulnerability in two of its firewall platforms — Secure Firewall ASA and Secure Firewall FTD — that allows an attacker to knock a device offline by forcing it to reload. The issue carries the identifier CVE-2026-76418 and is classified as a denial-of-service condition. Because the flaw can be reached over the network by someone who has not authenticated, any firewall instance exposed to untrusted networks deserves immediate attention.

The practical consequence is a loss of the very control point that organizations depend on to segment traffic and block intrusions. A reload interrupts inspection, drops active sessions, and can leave protected segments briefly reachable or unreachable depending on how the surrounding topology is built. For a school district or any agency running these appliances at the network edge, that translates into downtime for staff and students and a window in which monitoring and filtering are not functioning.

Denial-of-service bugs in perimeter equipment are especially troublesome because they demand no credentials and no user interaction — only reachability. Even where the attacker gains nothing beyond the outage, the disruption itself can be leveraged: outages mask other activity, force failover to less-tested paths, and consume staff time during recovery. The 2026 disclosure window means defenders should treat this as a live operational concern rather than a theoretical one.

Cisco's direction to customers is twofold: deploy the mitigations it has published and move to fixed software according to its guidance. Until patched, administrators should weigh whether every management and data interface truly needs exposure to the public internet, and should confirm that logging and alerting will surface an unexpected reboot quickly. Reviewing failover behavior and out-of-band access paths is worthwhile before an incident forces the question.

What to watch: Cisco's advisory for the precise affected releases and the fixed versions, any evidence of probing against firewall interfaces in your logs, and confirmation that high-availability pairs behave as expected if a member reloads. Treat unexpected appliance restarts as a possible exploitation signal until the estate is fully remediated.

What to do now

1. Inventory every Cisco Secure Firewall ASA and FTD instance, noting model, software release, and whether any interface is internet-facing.
2. Apply Cisco's published mitigations immediately for devices that cannot be patched in the current maintenance window.
3. Schedule and complete upgrades to the fixed software versions named in Cisco's advisory, prioritizing edge and internet-exposed appliances.
4. Restrict management access to trusted networks and disable unnecessary remote-access services on firewall interfaces.
5. Enable and centralize logging for device reloads and unexpected restarts, and alert on them as potential exploitation.
6. Validate high-availability and failover behavior so a single appliance reload does not create an outage or inspection gap.
7. Document the remediation timeline and re-scan the estate after patching to confirm no vulnerable releases remain.

Original source

CISA Known Exploited Vulnerabilities