# Agencies Prioritize Cisco Firewall Upgrades

Cisco reports active exploitation of CVE-2026-76418, a zero-day vulnerability with a CVSS score of 8.6 affecting ASA and FTD firewalls. The unauthenticated flaw can force affected devices to reload, disrupting VPN and network availability; fixed software releases are available. For agencies and contractors operating these products, the immediate operational and procurement concern is identifying affected, exposed configurations and prioritizing upgrades. Disabling secondary authentication is described as a temporary measure with security and compliance trade-offs.

- Agencies and contractors should inventory affected ASA and FTD devices and exposed VPN configurations, then prioritize upgrades to fixed releases.
- Procurement and IT teams may need to coordinate upgrade timing with network operators to reduce the risk of VPN and network disruption.
- Disabling secondary authentication is only a temporary mitigation and carries security and compliance trade-offs; the signal identifies no new solicitation, award, or contract opportunity.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 30, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)

### Vendors
- Cisco (Manufacturer of the affected ASA and FTD firewall products)

### Sources
- [CVE-2026-76418: Cisco ASA/FTD Zero-Day, CVSS 8.6 [2026]](https://tech-insider.org/cisco-asa-ftd-cve-2026-76418-ssl-vpn-zero-day-cvss-8-6-2026) - https://tech-insider.org/