Cisco ASA NULL pointer deref CVE-2026-76418 added to CISA KEV

1. Executive summary

CVE-2026-76418 is a NULL pointer dereference in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software, rated CVSS 8.6 HIGH (CWE-690, unchecked return value to NULL pointer dereference). CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-29 with a remediation due date of 2026-11-01, and Cisco states the flaw has been exploited in the wild. An unauthenticated remote attacker can force an affected firewall to reload, causing a denial of service; no VPN login is required to reach the vulnerable code path. For EMEA financial services the exposure is concentrated in internet-facing perimeter firewalls that terminate remote access VPN with secondary authentication configured, where a successful reload takes remote access offline and may interrupt traffic inspection. EPSS is 1%, so volume scanning is unlikely, but confirmed exploitation and KEV listing put this ahead of its EPSS rank for any asset matching the vulnerable configuration.

2. Regulatory framing

3. Technical analysis & attack chain

The flaw is a logic error in tunnel group handling when secondary authentication is configured. Cisco's advisory (cisco-sa-asaftd-tunnel-dos-s6mgkb75, 28 October 2026) attributes it to logic errors affecting tunnel groups configured with secondary authentication, and states that a successful VPN login is not required to reach the affected processing path. The result is a NULL pointer dereference that reloads the device.

Confirmed attack preconditions, all three required:

1. The firewall runs an unpatched ASA or FTD release (versions below).
2. The SSL VPN login service is reachable from the attacker's network position.
3. An affected tunnel group uses secondary authentication.

Attack chain:

1. The attacker identifies an internet-facing ASA or FTD device with the SSL VPN login service exposed.
2. The attacker sends a crafted request to the SSL VPN service during connection setup, before any authentication completes.
3. The request reaches the tunnel group processing path that handles secondary authentication and triggers the unchecked return value, dereferencing a NULL pointer.
4. The device reloads unexpectedly, dropping VPN sessions and interrupting traffic handling for the duration of the restart.

Affected versions, from the CERT-FR advisory CERTFR-2026-AVI-1412:

• ASA 9.16 and earlier than 9.16.4.104
• ASA 9.18.x earlier than 9.18.4.96
• ASA 9.20.x earlier than 9.20.4.50
• ASA 9.22.x earlier than 9.22.3.200
• ASA 9.23.x earlier than 9.23.1.48
• ASA 9.24.x earlier than 9.24.1.279.24.10.1 (the version string is reproduced as published; treat the boundary as 9.24.1.279 and confirm the exact fixed build with Cisco before relying on it)
• FTD 10.0.x earlier than 10.0.3
• FTD 10.1.x earlier than 10.1.1
• FTD 7.0 and earlier than 7.0.11
• FTD 7.2.x earlier than 7.2.13
• FTD 7.4.x earlier than 7.4.9
• FTD 7.6.x earlier than 7.6.7
• FTD 7.7.x earlier than 7.7.14

Not vulnerable, per Cisco via SecurityWeek: cloud-delivered firewall and management offerings, Secure Access, and Secure Firewall Management Center.

No workarounds exist. Cisco notes that exposure can be reduced by turning off the tunnel group list or removing secondary authentication, depending on the default tunnel group's settings, but warns that dropping secondary authentication weakens remote access VPN security and recommends upgrading instead.

The NVD record classifies the flaw as CWE-690 (unchecked return value to NULL pointer dereference); Cisco's own description frames it as logic errors in tunnel group secondary authentication handling. Both describe the same defect: a return value that is not checked before use.

Attribution and exploitation detail are unconfirmed. Cisco learned in October that the flaw was being exploited but has not disclosed the attacks or the actors behind them, and it is unclear whether the same actor behind CVE-2026-20349 (an August 2026 ASA/FTD HTTP request processing flaw, also CVSS 8.6, also exploited for reload-based DoS through the Remote Access SSL VPN service) is responsible. No MITRE ATT&CK profile is associated with any actor for this item, so no attribution is made. The exploitation status rests on Cisco's statement, corroborated by CERT-FR and CISA KEV; the technical preconditions rest on Cisco's advisory as reported by SecurityWeek, which is a single secondary source for the tunnel group detail.

4. Mitigation & containment

P1 (within 24 hours):

• Inventory every ASA and FTD device and compare its running version against the affected list above. Prioritise any device with the SSL VPN login service reachable from the internet and a tunnel group using secondary authentication.
• Patch to the fixed release for the running train (ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.279 or later; FTD 10.0.3, 10.1.1, 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14 or later). Confirm the exact fixed build against Cisco's advisory before scheduling.
• Where patching cannot complete inside the CISA due date of 2026-11-01, reduce exposure on the affected tunnel group by disabling the tunnel group list or removing secondary authentication, accepting the weaker VPN posture Cisco flags, and record the compensating control.
• Restrict reachability of the SSL VPN login service to known source ranges at the perimeter where operationally possible, so the crafted request cannot arrive from arbitrary internet addresses.

P2 (within 72 hours):

• Confirm HA pairs fail over cleanly and that a reload of one node does not drop remote access; test the failover path for the VPN service specifically.
• Add monitoring for unexpected reloads on ASA and FTD (syslog reload and crash messages, SNMP trap on cold start) and alert on repeated reloads of the same device within a short window, which is the observable signature of a sustained DoS attempt.
• Review VPN concentrator logs for connection attempts to the SSL VPN service that terminate before authentication completes, clustered by source address.

P3 (within 7 days):

• Fold ASA/FTD version state into the asset and supplier inventory so the next perimeter CVE can be matched to devices without a fresh discovery pass.
• Re-test remote access VPN configuration after any change to secondary authentication to confirm the intended authentication path is still enforced.

5. Indicators of compromise

No indicators of compromise available in the source material. The sources describe no atomic indicators (no hashes, domains, IP addresses, or filenames) and no exploitation infrastructure.

Behavioural indicators:

These behaviours are single-sourced to Cisco's advisory as reported by SecurityWeek; verify against your own baseline before alerting on them.

6. Detection

Insufficient indicators to author detection rules. The sources provide no artefact of the exploit itself (no request string, payload, filename, or command line), only the affected product, version ranges, and configuration preconditions. A rule built on the CVE identifier or product name would detect reporting about the flaw, not exploitation of it. Detection should instead rest on the behavioural indicators in §5: unexpected reload events and pre-authentication connection attempts against the SSL VPN service.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

7. Sources

• NVD, CVE-2026-76418, https://nvd.nist.gov/vuln/detail/CVE-2026-76418, 2026-10-29
• ANSSI CERT-FR, Vulnérabilité dans les produits Cisco (CERTFR-2026-AVI-1412), https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1412/, 2026-10-29
• Cisco, cisco-sa-asaftd-tunnel-dos-s6mgkb75, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75, 2026-10-28
• SecurityWeek, Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August, https://www.securityweek.com/attackers-exploit-second-cisco-firewall-vpn-zero-day-since-august/
• The Hacker News, Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls, https://thehackernews.com/2026/10/cisco-patches-actively-exploited-asa.html
• The Hacker News, Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS (CVE-2026-20349 context), https://thehackernews.com/2026/08/cisco-asa-and-ftd-flaw-exploited-in.html
• NVD, CVE-2026-20349 (CISA KEV, prior ASA/FTD DoS), https://nvd.nist.gov/vuln/detail/CVE-2026-20349

8. Adverse Trace position

Adverse Trace assesses CVE-2026-76418 as CVSS 8.6 HIGH, in CISA KEV since 2026-10-29 with a remediation due date of 2026-11-01, EPSS 1%, and confirmed in-the-wild exploitation per Cisco. The impact is availability only: an unauthenticated reload of a perimeter firewall, not code execution or data access, so the client impact is loss of remote access VPN and inspection capacity for the duration of each reload, with repeated exploitation able to keep a device cycling. The narrow preconditions (SSL VPN login reachable plus secondary authentication in an affected tunnel group) mean many estates are not exposed, and clients should confirm their configuration before treating this as urgent. Attribution is unconfirmed: Cisco has disclosed no actor, and no MITRE ATT&CK profile is associated with this item. The tunnel group mechanism is single-sourced to Cisco via SecurityWeek and should be verified against the Cisco advisory before configuration changes are made on its basis. We will track Cisco advisory updates and any further KEV or exploitation reporting, and will reissue if fixed-version guidance or exploitation detail changes. Clients should confirm ASA/FTD patch state against the version list in §3 and report completion against the 2026-11-01 deadline.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.