CVE-2026-76418: Cisco Secure Firewall ASA/FTD Denial of Service Vulnerability

Overview

CVE-2026-76418 addresses a critical denial of service vulnerability in Cisco Secure Firewall ASA and FTD Software. An unauthenticated, remote attacker can trigger an unexpected device reload by sending crafted requests to the SSL remote access VPN service. This vulnerability is due to logic errors related to secondary authentication on tunnel groups and is currently listed in CISA’s Known Exploited Vulnerabilities Catalog.

Technical Analysis

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

• Vulnerability Type: Unchecked return value to NULL pointer dereference (CWE-690).
• Affected Products: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software.
• Attack Vector: Remote Access SSL VPN service.
• Prerequisites: Secondary authentication must be configured on a tunnel group.
• Exploitation: An unauthenticated, remote attacker sends a crafted request when connecting to the SSL remote access VPN.
• Impact: A successful exploit causes the affected device to reload, resulting in a denial of service (DoS) condition.
• CVSS 3.1 Score: 8.6 (HIGH) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Detection

• Monitor Cisco ASA/FTD device logs for unexpected reloads or crashes, specifically looking for system messages indicating a reload event.
• Look for an increased volume of failed or abnormal SSL VPN connection attempts preceding a device reload.
• Analyze network traffic for unusual or malformed SSL VPN connection requests, particularly those targeting devices with secondary authentication configured.
• Review device uptime and availability metrics for unexpected interruptions.

Sigma Detection Rules

Cisco ASA FTD Unexpected Device Reload

title: Cisco ASA FTD Unexpected Device Reload
id: 90f7a01d-5b3e-4f1c-9e2a-7b8d6c5f4e3c
status: experimental
description: Detects unexpected device reloads in Cisco ASA/FTD logs, indicative of a denial of service condition or system instability.
logsource:
  product: cisco
  service: asa
detection:
  selection:
    message|contains:
      - 'Reloading due to'
      - 'System is restarting'
      - 'Device rebooted unexpectedly'
  condition: selection
level: high

Mitigations

1. Apply security patches from Cisco as soon as they become available. (As of the NVD publication date, the vulnerability is undergoing analysis, and patches are anticipated).
2. Review configurations of SSL remote access VPN tunnel groups to identify instances where secondary authentication is enabled.
3. Implement network segmentation to restrict access to the SSL VPN service from untrusted networks where possible.
4. Ensure robust logging and monitoring are in place for Cisco ASA/FTD devices to detect reloads or suspicious activity.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-76418
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76418
• https://ltna.com.au/cyber

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

• T1499 — Endpoint Denial of Service