Cisco ASA and FTD SSL VPN DoS flaw CVE-2026-76418 exploited

CISA has added CVE-2026-76418, a denial-of-service flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software, to its Known Exploited Vulnerabilities catalog, which confirms exploitation in the wild. The CISA KEV entry was added on 29 October 2026 and carries a remediation due date of 1 November 2026, so federal agencies have only days to act. This Cisco ASA vulnerability needs attention from anyone running the SSL VPN on these firewalls.

What happened

NVD published the record for CVE-2026-76418 on 28 October 2026, and CISA listed it in KEV the next day. CISA names it an unchecked return value leading to a NULL pointer dereference (CWE-690) in Cisco Secure Firewall ASA Software and Cisco Secure FTD Software.

According to the NVD description, an unauthenticated remote attacker can send a crafted request while connecting to the SSL remote access VPN and make the device reload unexpectedly. The result is a denial-of-service condition on the firewall. The trigger is a logic error that appears when secondary authentication is configured on a tunnel group.

The exploitation details, the identity of the attackers and the scale of the attacks have not been published. CISA lists known ransomware campaign use as unknown.

Am I affected by the Cisco ASA vulnerability?

You are likely in scope if all of the following are true:

• You run Cisco Secure Firewall ASA Software or Cisco Secure Firewall Threat Defense (FTD) Software.
• The Remote Access SSL VPN service is enabled.
• Secondary authentication is configured on a tunnel group.

The NVD record does not list affected version ranges, and no fixed version has been published in the records for this CVE. Check the Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for the authoritative list of affected releases for your platform.

Technical details

• Impact: unauthenticated remote denial of service; the device reloads.
• CVSS 3.1: 8.6 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. That means network reachable, low complexity, no privileges, no user interaction, changed scope, and a high availability impact only.
• Weakness: CWE-690, unchecked return value to NULL pointer dereference.
• Exploitation status: listed in CISA KEV, added 29 October 2026, due 1 November 2026.

CISA’s required action is to apply mitigations in accordance with vendor instructions and to follow its BOD 26-04 guidance on prioritising security updates based on risk. For cloud services, CISA says to follow the applicable guidance or discontinue use of the product if mitigations are unavailable. It also points to its forensics triage requirements.

Why this matters

This section is our analysis, not new reporting. A VPN gateway sits at the network edge and is reachable by design, and this flaw needs no credentials. A repeatable reload attack against it can take remote access away from an entire workforce, and for firewalls that also carry production traffic it can interrupt more than VPN. The impact is availability only according to the CVSS vector, so there is no indication in the records of data theft or code execution through this CVE.

The KEV listing is the deciding factor. Treat anything in KEV on an internet-facing device as a same-day task: verify exposure within hours, apply the vendor mitigation, and do not wait for the next maintenance window if the SSL VPN is reachable from the internet.

Detection and hunting ideas

No indicators of compromise have been published for this CVE. The following ideas follow from how the flaw works:

• Look for unexpected reloads or crashes of ASA and FTD devices, especially repeated ones, and correlate them with the time of inbound SSL VPN connection attempts.
• Review VPN logs for connection attempts to tunnel groups that use secondary authentication, particularly from sources that never complete authentication.
• Check for crash files or unexpected restarts in device logs, and keep them for the forensics triage steps CISA references.
• Alert on sudden drops in active remote access sessions.

What to do

1. Inventory every Cisco ASA and FTD device and identify which have the Remote Access SSL VPN enabled.
2. Find tunnel groups that use secondary authentication, since that configuration is the condition named in the NVD description.
3. Read the Cisco advisory and apply the mitigations it describes. If it lists no mitigation that fits, follow CISA’s instruction to stop using the affected service until one is available.
4. Meet the CISA due date of 1 November 2026 if you are a federal agency, and treat it as the target if you are not.
5. Restrict exposure of the VPN portal where possible, for example to known address ranges, while you work.
6. Preserve logs and crash data from any device that reloaded unexpectedly, and tell your incident response team.

We will update this post if Cisco or CISA publish fixed versions, more detail on the attacks, or further guidance.

Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.

Related coverage

• Cisco Secure Email Gateway path traversal added to CISA KEV (CVE-2026-76519)
• Cisco Nexus 9000 ACI contract bypass flaw fixed (CVE-2026-20038)
• Cisco Snort 3 hardening update fixes critical CVE-2026-20043

Sources

• CISA KEV catalog entry for CVE-2026-76418
• NVD: CVE-2026-76418
• Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75