Our automated tracking framework flagged that CISA added CVE-2026-76418 (Cisco Secure Firewall ASA Software and Cisco Secure FTD Software) to the Known Exploited Vulnerabilities (KEV) catalog on October 30, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-76418 by November 1, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-76418 |
| Vendor / product | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software |
| Vulnerability | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability |
| CVSS base score | 8.6 |
| Added to KEV | October 29, 2026 |
| Days public before listing (NVD → KEV lag) | 1 |
| Federal patch deadline | November 1, 2026 |
| Known ransomware use | No |
How This Compares to Cisco’s Track Record
This one was public for just 1 days before CISA confirmed exploitation — faster than Cisco’s 996-day median, meaning attackers moved unusually quickly. Cisco currently ranks #12 on our KEV Lag leaderboard.
| Cisco in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 102 |
| Median lag (public → KEV listing) | 996 days |
| 0-day rate (exploited at or before disclosure) | 18% |
| Entries tied to known ransomware campaigns | 6 |
For perspective, the median across all 1764 tracked KEV entries is 233 days — Cisco’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent Cisco KEV Additions
The most recent Cisco vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-76519 | Secure Email Gateway | October 14, 2026 | 0 | No |
| CVE-2026-76504 | Catalyst SD-WAN Manager | September 30, 2026 | 0 | No |
| CVE-2026-76460 | Identity Services Engine | September 16, 2026 | 0 | No |
| CVE-2026-76461 | Secure Email Gateway | September 14, 2026 | 0 | No |
| CVE-2026-20079 | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | September 9, 2026 | 189 | No |
Defense guide: How to Detect DDoS Attack: Warning Signs & Defense Playbook — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA has added CVE-2026-76418 to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability in Cisco Secure Firewall ASA Software and Cisco Secure FTD Software has a CVSS base score of 8.6. Organizations using these Cisco firewall products should patch before the federal deadline of November 1, 2026. CVE-2026-76418 was public for only one day before its KEV listing, indicating rapid exploitation after disclosure.
This quick KEV listing, with a federal patch deadline just three days away, emphasizes the urgency of CVE-2026-76418. While there’s no known ransomware use, the rapid exploitation points to a high potential for impact. Security teams managing Cisco Secure Firewall ASA and FTD deployments are most exposed and should treat this as a critical priority.
If you can’t patch before the deadline, restrict network access to affected devices, enhance network segmentation, and deploy intrusion detection/prevention systems to monitor for unusual activity. Vigilance and a rapid response are key to managing this actively exploited vulnerability.
Related Coverage
- Cisco’s CVE-2026-20316 Was Exploited in 0 Days — Well Under Its 1245-Day Median (July 2026)
- Cisco’s CVE-2026-20349 Was Exploited in 0 Days — Well Under Its 1245-Day Median (August 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
