CVE-2026-76418: Cisco ASA and FTD VPN DoS Vulnerability

Unauthenticated threat actors are actively exploiting a newly disclosed zero-day in enterprise perimeter firewalls, and the effect is blunt: critical network gateways crash and reload without warning. On October 29, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76418 to its Known Exploited Vulnerabilities (KEV) Catalog, just one day after Cisco’s Product Security Incident Response Team (PSIRT) published Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75.

The flaw lives in the Cisco Secure Firewall SSL VPN remote access service. It is rated 8.6 High under CVSS v3.1 (CWE-690: Unchecked Return Value to NULL Pointer Dereference) and affects 142 versions of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (9.16 through 9.24) and 67 versions of Cisco Secure Firewall Threat Defense (FTD) Software (7.0 through 10.1).

For global enterprises, government agencies, and managed security service providers (MSSPs), the risk is immediate. The bug triggers during the pre-authentication phase of a remote access VPN connection, so an attacker needs no valid credentials and no completed VPN login to take the appliance down.

If secondary authentication (secondary-authentication-server-group) is configured on a reachable tunnel group, including DefaultWEBVPNGroup secondary authentication, an unauthenticated attacker can send a crafted request that triggers the CSCwx26625 NULL pointer dereference.

The whole firewall then reloads unexpectedly, severing every active VPN tunnel, site-to-site interconnect, and inline traffic inspection. Under the CISA KEV BOD 26-04 mandate, Federal Civilian Executive Branch (FCEB) agencies and critical infrastructure defenders must prioritize rapid patching across all internet-exposed firewall appliances.

Quick Answer

CVE-2026-76418 (CVSS v3.1 8.6 High, CWE-690, Cisco Bug ID CSCwx26625) is an actively exploited zero-day in the Cisco Secure Firewall SSL VPN service of Cisco ASA (9.16–9.24) and Cisco FTD (7.0–10.1) software. Unauthenticated remote attackers send crafted VPN connection requests that exploit logic errors in DefaultWEBVPNGroup secondary authentication or custom tunnel groups, and the appliance reloads unexpectedly (DoS).

No complete workaround exists, and removing secondary authentication weakens multi-factor security. The practical answer is to upgrade to Cisco’s first fixed releases (such as ASA 9.24.1.27 / 9.20.4.50 or FTD 7.6.7 / 7.4.9) and satisfy the CISA KEV BOD 26-04 mandate.

What Happened & Incident Timeline

Most vulnerabilities come out of lab fuzzing. This one came out of live operational damage. According to Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75, Eric Fernald identified the defect while helping resolve an active Cisco Technical Assistance Center (TAC) customer support case (CSCwx26625).

Production firewalls running SSL remote access VPN services were reloading unexpectedly, and Cisco engineers traced the cause to crafted pre-authentication requests aimed at tunnel groups configured with secondary authentication. Those requests caused an unchecked return value to dereference a NULL pointer, which crashed the underlying firewall process and forced a full hardware or virtual appliance reboot.

On October 28, 2026, at 19:15 GMT, Cisco PSIRT published the final version 1.0 advisory along with fixed software for six ASA release tracks and seven FTD release tracks. The advisory states plainly that Cisco PSIRT became aware of active exploitation in October 2026.

As reported by SecurityWeek, this is the second Cisco firewall VPN zero-day exploited in the wild since August 2026. Less than 24 hours after Cisco’s disclosure, on October 29, 2026, CISA added the vulnerability to its KEV Catalog alongside GitLab flaw CVE-2026-97229. That listing invokes Binding Operational Directive (BOD) 26-04 for federal agencies and urges commercial enterprises to remediate exposed VPN concentrators immediately.

Vulnerability / Threat Facts at a Glance

The table below consolidates the verified technical specifications from Cisco PSIRT, the NIST National Vulnerability Database, and CISA’s October 29 KEV alert.

Affected and Fixed Versions

Cisco’s Fixed Software matrix and Brandefense’s track analysis agree on what makes an appliance exposed. It must run a vulnerable ASA or FTD release, have reachable SSL Remote Access VPN (webvpn + enable <interface_name>), and have secondary authentication (secondary-authentication-server-group) configured in the active tunnel-group scope. Cloud-delivered Firewall (CDFW), Cloud-delivered FMC (cdFMC), Cisco Secure Access (CSA), and standalone Secure FMC Software are confirmed not vulnerable.

Technical Attack Chain

1. Initial Access: Probing Reachable webvpn Interfaces (T1190 / T1133)

Cisco ASA and FTD appliances typically terminate external Remote Access SSL VPN connections (T1133: External Remote Services) on internet-facing interfaces where webvpn and enable <interface_name> are active.

Many teams add defense-in-depth by configuring dual or secondary authentication (secondary-authentication-server-group) inside their VPN connection profiles, also called tunnel groups. Users then have to prove primary Active Directory/LDAP credentials and also pass a secondary RADIUS, Duo, or SAML/TOTP challenge.

Here is the catch. As Cisco’s advisory confirms, a successful VPN login is not required to reach the vulnerable code path.

2. Execution: Triggering the CWE-690 Unchecked Return Value to NULL Pointer Dereference

When an unauthenticated remote client starts a handshake with the Cisco Secure Firewall SSL VPN service, the appliance parses the request parameters against the target tunnel group’s authentication policy. A logic error in the SSL VPN daemon shows up when secondary-authentication-server-group is present on the evaluated tunnel group.

Under abnormal request conditions, an internal function returns a NULL pointer and the calling routine never checks it (CWE-690). The process then dereferences that NULL address, which is the core mechanism of the CSCwx26625 NULL pointer dereference, and the operating system triggers an unhandled segmentation fault or watchdog crash.

[Unauthenticated Attacker]
       |
       | 1. Crafted Pre-Auth HTTPS/SSL VPN Request (No Valid Credentials Needed)
       v
[Cisco ASA / FTD Outside Interface: webvpn enable <interface_name>]
       |
       | 2. Evaluates Target Tunnel Group (Named Profile or DefaultWEBVPNGroup)
       |    where "secondary-authentication-server-group" is configured
       v
[CWE-690 Logic Error: Unchecked Return Value -> NULL Pointer Dereference (CSCwx26625)]
       |
       | 3. Watchdog Crash & Unexpected Full Appliance Reload (Changed Scope S:C / DoS)
       v
[Total Loss of VPN Concentrator Availability & Active Firewall Sessions (MITRE T1499.004)]

3. Impact & Scope Change (S:C): Why DefaultWEBVPNGroup Creates a Hidden Trap

The CVSS v3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) includes a Changed Scope (S:C) rating for a reason. Crashing the SSL VPN handler forces the entire physical or virtual firewall to reload (T1499.004: Endpoint Denial of Service – Application or System Exploitation). Routing, NAT, and firewall inspection all go down, well beyond the VPN subsystem itself.

Cisco engineers also flagged a configuration nuance that catches many administrators off guard.

Case A (tunnel-group-list enable is configured): If the VPN login portal lets users select connection profiles, every configured tunnel group is reachable and vulnerable, not just the profiles shown in the login dropdown. The built-in DefaultWEBVPNGroup is in scope too, as long as any of them has secondary-authentication-server-group configured.

Case B (tunnel-group-list enable is absent or disabled): Hiding the tunnel group list (no tunnel-group-list enable) does not close the door. The appliance still routes unmapped connection requests to the default tunnel group, DefaultWEBVPNGroup. If DefaultWEBVPNGroup secondary authentication is enabled, the firewall remains 100% exploitable.

4. What the Attacker Did Next

Cisco PSIRT and Brandefense both stress that this is an availability and denial-of-service flaw (C:N/I:N/A:H). It does not grant remote code execution on its own. Still, firewall reload bugs tend to be useful to adversaries in three ways, and CyberInfos expects defenders to plan for each one.

Sustained reload loops against critical remote workforces.

A single crafted packet each time the ASA or FTD interface comes back online can keep a primary VPN concentrator in a perpetual reload loop. Remote employees, third-party contractors, and out-of-band SOC responders get locked out.

Fail-open and HA failover exhaustion.

In High Availability (HA) active/standby pairs, repeated rapid reloads push traffic to the secondary appliance. The same crafted request then crashes the standby unit, and the whole HA cluster collapses.

Distraction and telemetry blinding during multi-vector intrusions.

Noisy perimeter reloads can blind inline IDS/IPS inspection or pull network operations teams away while the adversary exploits web-tier RCE or identity vulnerabilities elsewhere in the environment.

Why Patching Alone May Not Be Enough

Treating this advisory as a routine version check, or applying CLI mitigations without thinking them through, creates its own operational and security risks.

The MFA downgrade trap in Cisco’s temporary mitigation.

Cisco explicitly warns that no true workaround exists for this CSCwx26625 NULL pointer dereference, and it documents a two-case temporary mitigation. In Case 2, where DefaultWEBVPNGroup uses secondary authentication, the only CLI mitigation (no secondary-authentication-server-group) strips secondary authentication from the default VPN group entirely.

That stops the crash, but it also removes secondary MFA enforcement on the VPN portal. The result is an immediate authentication-downgrade risk that password-spraying and credential-stuffing actors can abuse.

FMC policy versus deployed device configuration drift.

On Cisco Secure FTD appliances managed through Firewall Management Center (FMC), checking the intended policy in the FMC GUI is not enough. Inspect the actual deployed running configuration on the FTD sensor itself. Un-deployed policy changes or inherited DefaultWEBVPNGroup attributes can leave secondary-authentication-server-group active on the wire.

Pre-patch crash forensics and BOD 26-04 expectations.

Under the CISA KEV BOD 26-04 mandate, agencies must do more than apply the patch. They also need to evaluate whether threat actors targeted or disrupted the asset before patching, by inspecting crashinfo dumps and syslog reload reasons.

Indicators of Compromise (IOCs) & Hunting Telemetry

Cisco PSIRT has not published specific attacker IP addresses from the October 2026 TAC investigations. Defenders therefore have to hunt for concrete appliance crash artifacts, syslog reload signatures, and configuration exposure indicators across ASA, FTD, and SIEM platforms.

SOC & IT Emergency Response Checklist

Network engineering and SOC teams should work through this six-step verification, hunting, and patching workflow now.

Step 1: Audit exact ASA / FTD exposure via CLI, including DefaultWEBVPNGroup.

Do not rely on login page dropdown lists. Run these read-only commands on Cisco ASA (or through the FTD diagnostic CLI) to confirm whether webvpn and DefaultWEBVPNGroup secondary authentication are active.

! Step 1A: Verify whether SSL Remote Access VPN is enabled on any interface
show running-config webvpn

! Step 1B: Check whether tunnel-group-list is enabled
show running-config webvpn | include tunnel-group-list

! Step 1C: Inspect ALL tunnel groups AND explicitly inspect DefaultWEBVPNGroup for secondary authentication
show running-config tunnel-group | include tunnel-group|secondary-authentication-server-group
show running-config all tunnel-group DefaultWEBVPNGroup | include secondary-authentication-server-group

Step 2: Inspect appliance uptime, reload reasons, and crashinfo dumps.

Check whether any perimeter firewall has already been hit by unauthenticated reload attacks.

! Check last reload timestamp and reload reason
show version | include up|Reload|reason

! List any crashinfo dumps written to flash storage
dir disk0:/ | include crashinfo

Step 3: Run SIEM threat-hunting queries for unexpected reloads and SSL VPN probes.

These Splunk SPL and Microsoft Sentinel KQL queries correlate SSL VPN connection spikes with unexpected firewall restarts.

/* Splunk SPL: Correlate Cisco ASA/FTD SSL VPN handshakes with unexpected reload events */
index=network_firewall sourcetype IN ("cisco:asa", "cisco:ftd")
(message_id IN ("199017", "199016", "725001", "725007", "722051") OR "crashinfo" OR "Traceback")
| stats count values(message_id) as msg_ids earliest(_time) as first_seen latest(_time) as last_seen by host, src_ip
| where mvfind(msg_ids, "199017") >= 0 OR mvfind(msg_ids, "199016") >= 0

// Microsoft Sentinel KQL: Detect Cisco ASA/FTD reload syslog events preceded by external SSL VPN handshakes
CommonSecurityLog
| where DeviceVendor == "Cisco" and DeviceProduct in ("ASA", "FTD")
| where DeviceEventClassID in ("199017", "199016") or Message has_any ("crashinfo", "Traceback", "Reload reason")
| project TimeGenerated, Computer, DeviceAddress, DeviceEventClassID, Activity, Message
| order by TimeGenerated desc

Step 4: Weigh the temporary CLI mitigation trade-offs before applying anything.

If you cannot deploy fixed software right away during business hours, review Cisco’s two temporary mitigation cases with your CISO and IAM team.

• Case 1 (DefaultWEBVPNGroup does NOT use secondary authentication, but other tunnel groups do): Enter no tunnel-group-list enable under webvpn configuration mode. Operationally, users can no longer pick a profile from a dropdown and must know their exact group URL or alias.
• Case 2 (DefaultWEBVPNGroup DOES use secondary authentication): Cisco notes that no secondary-authentication-server-group removes the exposure, but it lowers VPN security by disabling secondary authentication. Rather than stripping MFA on an internet-facing VPN, push for an emergency maintenance window and install the fixed software build.

Step 5: Upgrade to the exact first fixed release for your track.

Match each appliance’s current software branch to Cisco’s fixed release: 9.24.1.27 or 9.24.10.1 (ASA 9.24), 9.23.1.48 (ASA 9.23), 9.22.3.200 (ASA 9.22), 9.20.4.50 (ASA 9.20), 9.18.4.96 (ASA 9.18), 9.16.4.104 (ASA 9.16), or FTD 10.1.1, 10.0.3, 7.7.14, 7.6.7, 7.4.9, 7.2.13, and 7.0.11. Use High Availability (HA) zero-downtime failover sequencing.

Step 6: Verify the running build and restore full policy after the upgrade.

Run show version on each unit, then check the deployed policies in Cisco Secure FMC/FDM. Confirm that the patched build is active and that every secondary authentication control is still intact.

Global Regulatory & Compliance Implications (USA, UK, Australia, EU & India)

Perimeter firewalls and remote access VPN concentrators form the primary security boundary for critical infrastructure and corporate networks. Active exploitation of CVE-2026-76418 can therefore trigger mandatory compliance and incident reporting duties in several jurisdictions.

Disclaimer: This multi-jurisdiction compliance summary is provided for operational security readiness and defensive planning purposes only and does not constitute formal legal advice. Organizations should consult qualified legal counsel when evaluating statutory incident reporting obligations.

CyberInfos Analyst Insight

Based on our technical review of Cisco Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 and CISA’s October 29 KEV directive, CyberInfos sees three strategic takeaways for global CISOs and network defenders.

CyberInfos Assesses That Hidden Default Profiles (DefaultWEBVPNGroup) Are a Systemic Firewall Blind Spot.

During rapid triage, network engineers tend to inspect only the VPN connection profiles that end users see on the login portal. As CVE-2026-76418 proves, default fallback profiles like DefaultWEBVPNGroup stay reachable at the protocol parser level even when tunnel-group-list enable is disabled. Auditing show running-config all tunnel-group DefaultWEBVPNGroup on every perimeter appliance belongs in your standard baseline hardening checks.

Never Trade Away Multi-Factor Authentication to Mitigate a DoS Bug.

When a vendor’s only temporary mitigation for a denial-of-service bug is to disable secondary-authentication-server-group, defenders face an asymmetric trap. They would be swapping a temporary availability risk (an appliance reload) for a serious confidentiality and integrity risk: single-factor VPN access exposed to credential stuffing. CyberInfos strongly advises against stripping secondary authentication on internet-facing VPNs. Speed up out-of-band HA patching to the fixed release instead.

Availability Zero-Days on Edge Concentrators Are Force Multipliers for Extortion & Espionage. SecurityWeek notes this is the second Cisco firewall VPN zero-day exploited in the wild since August 2026, and concurrent campaigns are chaining web RCEs and kernel exploits on firewall appliances. Adversaries increasingly weaponize pre-auth reload bugs to test how edge sensors respond, to disrupt incident response communications, and to force failovers during broader network intrusions.

Frequently Asked Questions (FAQ)

What is CVE-2026-76418 in Cisco Secure Firewall ASA and FTD?

It is an actively exploited, high-severity (CVSS v3.1 8.6, CWE-690) vulnerability in the Cisco Secure Firewall SSL VPN service of Cisco ASA and FTD software (CSCwx26625). An unauthenticated remote attacker can send crafted VPN connection requests that trigger a NULL pointer dereference and force the device to reload unexpectedly.

Does CVE-2026-76418 allow remote code execution (RCE) on the firewall?

No. According to Cisco PSIRT and NIST NVD, this is an unauthenticated remote denial-of-service (DoS) flaw. An unchecked return value to NULL pointer dereference (the CSCwx26625 NULL pointer dereference) forces an unexpected device reload, and it does not give the attacker code execution.

Does disabling the VPN tunnel-group list (no tunnel-group-list enable) fully protect an appliance?

Not if the default tunnel group (DefaultWEBVPNGroup) has secondary authentication configured. Cisco explicitly warns that even when tunnel-group-list enable is absent or disabled, an appliance remains vulnerable if DefaultWEBVPNGroup secondary authentication (secondary-authentication-server-group) is enabled in the running configuration.

Why did CISA add this Cisco firewall flaw to the KEV Catalog on October 29, 2026?

Cisco PSIRT confirmed active exploitation in the wild during October 2026 TAC investigations, and CISA responded by adding the flaw to the Known Exploited Vulnerabilities Catalog. Federal agencies must now prioritize remediation and pre-patch compromise checks under the CISA KEV BOD 26-04 mandate.

Which Cisco products are confirmed not vulnerable to this SSL VPN flaw?

Cisco confirmed that Cloud-delivered Firewall (CDFW), Cloud-delivered Firewall Management Center (cdFMC), Cisco Secure Access (CSA), and standalone Cisco Secure Firewall Management Center (FMC) Software are not vulnerable. ASA/FTD appliances with SSL Remote Access VPN (webvpn) completely disabled are not affected either.

Final Thoughts

The rapid addition of CVE-2026-76418 to the CISA KEV Catalog on October 29, 2026, shows how quickly threat actors go after enterprise SSL VPN concentrators once a pre-authentication flaw surfaces.

Because the CSCwx26625 NULL pointer dereference needs no valid credentials to crash an appliance, and because stripping secondary authentication weakens your perimeter MFA posture, upgrading to Cisco’s fixed software releases is the only safe path forward.

Run the show running-config all tunnel-group DefaultWEBVPNGroup check across your Cisco ASA and FTD fleet today. Look at show version and disk0:/ for unexpected October reload artifacts, and schedule immediate High Availability upgrades to the first fixed release for your software track. Share your firewall upgrade notes with fellow network defenders in the comments below, and subscribe to the CyberInfos.in newsletter and RSS feed for daily zero-day and CISA KEV alerts.