Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
Cisco — Secure Firewall ASA Software and Cisco Secure FTD Software
- Added to KEV catalog
- 29 October 2026
- Federal remediation due date
- 1 November 2026
- Weakness classification (CWE)
- CWE-690
AI Breakdown
What it is
A flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD software allows an unauthenticated remote attacker to crash the firewall. This occurs due to a logic error when secondary authentication is configured on a tunnel group. An attacker can trigger the issue by sending a crafted request during an SSL VPN connection attempt, forcing the device into an unexpected reload.
Why it matters
This vulnerability carries a severe CVSS score of 8.6 and is confirmed to be actively exploited in the wild via CISA's catalog. Although known ransomware use is currently listed as unknown, attackers can remotely take down network firewalls without needing valid credentials. An outage of this type immediately severs remote access and disrupts vital network operations.
Recommended action
Apply vendor mitigations and software updates across all affected Cisco ASA and FTD devices in accordance with CISA BOD 26-04 guidance prior to the November 1, 2026 deadline. Evaluate the internet exposure of all VPN endpoints and perform recommended forensics triage to check for disruption or compromise. If effective mitigations are unavailable, isolate the affected VPN services or discontinue use of the product.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76418
NVD Technical Description
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
More Cisco Vulnerabilities
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
Cisco Secure Email Gateway SQL Injection Vulnerability
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services