CVE-2026-76418: Cisco Secure Firewall ASA/FTD SSL VPN Reload DoS (KEV, Exploited)

CVE-2026-76418 is an unchecked-return-value flaw causing a NULL pointer dereference in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD Software; a remote, unauthenticated attacker can send a crafted request to a tunnel group that has secondary authentication configured and force the device to reload, and Cisco confirmed active exploitation of it in October 2026 before a patch was broadly available.

CVE-2026-76418 is a CWE-690 (Unchecked Return Value to NULL Pointer Dereference) vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. NVD's description states the flaw "is due to logic errors when secondary authentication is configured on a tunnel group," and that "an attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN," causing the device to reload and triggering a denial-of-service condition (NVD).

As of this review NVD lists the CVE's vulnStatus as "Undergoing Analysis" and has not yet published its own Primary CVSS score; the only metric on record is a CNA (Cisco PSIRT) Secondary score of CVSS v3.1 8.6 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H — network-reachable, low complexity, no privileges or user interaction required, high availability impact only (NVD).

Cisco's own security advisory states plainly: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability," and that "there are no workarounds that address this vulnerability" (disabling secondary authentication on the affected tunnel groups removes the exposure but changes authentication behavior). Cisco lists ASA Software 9.16 through 9.24 and FTD Software 7.0 through 10.1 as affected, with fixes in ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 and 9.24.10.1, and FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1 (Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75).

CISA added CVE-2026-76418 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-29, one day after Cisco's advisory, with a required-action due date of 2026-11-01 under CISA's Binding Operational Directive 26-04 — an unusually short remediation window reflecting the confirmed in-the-wild exploitation (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.0057 (47.308th percentile); this is a notably low EPSS figure for a KEV-listed, actively exploited CVE, likely reflecting the short time elapsed since disclosure and the narrow DoS-only impact rather than remote code execution (FIRST EPSS).

This is the second Cisco Secure Firewall ASA/FTD remote-access VPN denial-of-service vulnerability added to KEV in 2026, following CVE-2026-20349 in August. Given Cisco states there is no workaround short of patching, any internet-facing ASA or FTD device offering remote-access SSL VPN with secondary authentication should be updated to a fixed release immediately.

• Unchecked return value / NULL pointer dereference in the Remote Access SSL VPN of Cisco ASA/FTD, triggered by a crafted request to a tunnel group with secondary authentication configured, causes an unauthenticated remote reload (DoS). — NVD
• NVD vulnStatus is Undergoing Analysis with no NVD Primary score; the only metric is a Cisco PSIRT Secondary CVSS v3.1 score of 8.6, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. — NVD
• Cisco confirmed active exploitation in October 2026, states there are no workarounds, and lists affected/fixed ASA and FTD versions. — Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-29 with a required-action due date of 2026-11-01. — CISA KEV
• EPSS score is 0.0057 (47.308th percentile) as of 2026-10-29. — FIRST EPSS