US federal agencies face a deadline of Sunday 1 November to patch an exploited Cisco firewall flaw that can knock a device offline, after the country's cybersecurity agency gave the bug an unusually short three-day fix window.

The flaw, tracked as CVE-2026-76418, affects Cisco Secure Firewall ASA and Secure Firewall Threat Defense software. According to Cisco's advisory, published on 28 October, an unauthenticated remote attacker can send a crafted request to the remote-access SSL VPN service and force the device to reload. Cisco rates the flaw High, with a CVSS score of 8.6. It is a denial-of-service attack: no data theft is described, but the firewall goes down, cutting remote access for staff who depend on the VPN.

Why the deadline is so short

The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalogue on 29 October, a listing that means there is reliable evidence of attacks in the wild. The three-day deadline is a clear signal that the flaw should not wait for the next maintenance window. The bug bites only in a specific combination: a vulnerable release, remote-access SSL VPN enabled, and secondary authentication configured in a tunnel group.

Cisco has published fixed releases, with no full workaround, only mitigations. Operators should upgrade and check whether any device was already compromised, since patching alone does not remove an attacker who is already inside.

A second deadline on the same day

A second deadline also falls on 1 November: self-managed GitLab installations must patch a regex-engine flaw, CVE-2026-97229, and check their Ruby version as well as GitLab. October was a heavy month for edge-device flaws, with a dozen exploited products added to the catalogue, from mail gateways and VPNs to firewalls and remote-support tools.