Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

🚨SEVERITY: HIGH — CVSS 8.6Security Advisory

TL;DR 📌

  • Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
  • Highest CVSS: 8.6 (High).
  • Listed in CISA KEV (2026-10-29) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-76418.

What it is

CVE-2026-76418 affects the Remote Access SSL VPN service in Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. The flaw is an unchecked return value that leads to a NULL pointer dereference.

It’s triggered by logic errors that occur when secondary authentication is configured on a tunnel group. An unauthenticated, remote attacker can send a crafted request while connecting to the SSL remote access VPN service to hit this condition — no credentials or prior session are needed, and the attack is carried out over the network against the VPN termination point itself.

The impact is a device reload. Successful exploitation causes the ASA or FTD unit to restart, which takes down whatever firewall and VPN services it was providing for the duration of the reload. There is no indication of code execution or data exposure — this is a denial of service against the data plane / remote access VPN function, not a management-plane compromise.

CVE-2026-76418 is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-10-29, so it is known to be exploited.

What to do

  • Check whether Remote Access SSL VPN is enabled on your ASA or FTD devices and whether secondary authentication is configured on any tunnel group — this is the specific configuration that exposes the flaw.
  • Consult the Cisco advisory for fixed software releases; none are listed in the facts available here, so confirm the exact fixed version for your platform and train directly against Cisco’s published release information before planning an upgrade.
  • Given the KEV listing, treat this as a priority patching action rather than a routine update cycle — devices with Remote Access SSL VPN exposed to the internet are the ones at risk of unauthenticated reload attempts.
  • If patching cannot happen immediately, consider restricting access to the SSL VPN service to trusted source addresses where operationally possible, as a stopgap while you schedule the update.
  • Monitor for unexpected reloads on affected ASA/FTD units, since repeated unplanned restarts of the SSL VPN service may indicate exploitation attempts.

For leadership 🧭

Executive summary. Any Cisco ASA or FTD device running Remote Access SSL VPN with secondary authentication configured on a tunnel group can be crashed remotely by an unauthenticated attacker, and this is already listed as exploited in CISA’s KEV catalogue. Because the firewall itself goes down, this needs priority handling now rather than waiting for a routine patch cycle.

Why it matters:

  • The flaw sits in the Remote Access SSL VPN service of ASA/FTD, the same component remote staff use to connect into the network, so exploitation targets your perimeter VPN termination point directly.
  • No authentication or prior session is required — a single crafted request during the VPN connection handshake is enough to trigger the NULL pointer dereference.
  • Successful exploitation reloads the device, dropping firewall and VPN service for every user and site relying on that appliance, not just the VPN session being attempted.
  • It is in CISA’s KEV catalogue (added 2026-10-29), meaning exploitation activity has already been observed, not just a theoretical risk.

Now / Next / Later:

  • Now: Check every ASA and FTD device for Remote Access SSL VPN enabled and secondary authentication configured on any tunnel group — this is the exact combination that exposes the device.
  • Next: Obtain the Cisco-published fixed release for your specific ASA/FTD platform and schedule the upgrade in the next change window, treating it as KEV-driven priority patching.
  • Later: Where SSL VPN cannot be fully locked down immediately, restrict access to trusted source IP ranges and add monitoring for unexpected device reloads as a standing control against this class of unauthenticated DoS.

Source