Cisco ASA/FTD SSL VPN secondary auth NULL pointer dereference DoS

CVE-2026-76418 is a denial-of-service vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall ASA Software (versions 9.16.1 through 9.24.10) and Cisco Secure Firewall Threat Defense Software (versions 7.0.0 through 10.1.0). The root cause is a logic error in the code path that processes secondary authentication on VPN tunnel groups — specifically, an unchecked return value leads to a NULL pointer dereference (CWE-690). When an unauthenticated attacker sends a crafted request during the SSL VPN connection process, the device crashes and fully reloads. No credentials are required; the vulnerable code path is reached *before* authentication completes. The cruel irony: organizations that configured secondary-authentication-server-group — typically RADIUS-based MFA — to *harden* their VPN are the only ones exposed to this crash. Cisco tracks this as Bug ID CSCwx26625 under advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75.

Cisco rates this HIGH at 8.6, and that baseline is broadly defensible for the access profile. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) reflects the worst-case attacker position — unauthenticated, remote, low complexity, with scope change because crashing the firewall disrupts every service behind it. However, the 8.6 does not account for the configuration prerequisite: only devices with secondary-authentication-server-group set on at least one tunnel group are vulnerable. This meaningfully narrows the exposed population — the feature is common in security-mature enterprises but far from universal across the installed base. We adjust to 7.8 to reflect that friction. Critically, Cisco PSIRT confirmed active exploitation in October 2026, the same month as disclosure. This is not theoretical. Attackers have working exploits, and the mandatory upgrade cadence should reflect that reality regardless of the decimal in the score.

Sources.

1. Cisco Security Advisory (cisco-sa-asaftd-tunnel-dos-s6mgkb75)
2. Strix AI — CVE-2026-76418 detail page
3. Offseq Radar — CVE-2026-76418 threat intelligence
4. BleepingComputer — Cisco ASA/FTD VPN flaw context
5. Eclypsium — Cisco ASA scanning surge and exposure analysis
6. SC World — Shadowserver exposure data on ASA/FTD devices
7. TheHackerWire — CVE-2026-76418 analysis

Run from an auditor workstation with SSH access to the target Cisco ASA or FTD device. Invoke as bash check_cve_2026_76418.sh <device_ip> [ssh_user] (e.g., bash check_cve_2026_76418.sh 10.1.1.1 admin). Requires SSH credentials with privilege level sufficient to execute show running-config and show version.

#!/usr/bin/env bash
# CVE-2026-76418 Vulnerability Check — Cisco ASA/FTD
# Checks: (1) SSL VPN enabled, (2) secondary-authentication-server-group configured
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED  1=VULNERABLE  2=UNKNOWN
set -uo pipefail

HOST="${1:?Usage: $0 <device_ip_or_hostname> [ssh_user]}"
USER="${2:-admin}"

rcmd() {
  ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o BatchMode=yes \
      "${USER}@${HOST}" "$1" 2>/dev/null
}

echo "=== CVE-2026-76418 check: ${HOST} ==="

# Step 1: Check if SSL VPN (webvpn) is enabled on any interface
WV=$(rcmd "show running-config webvpn") || {
  echo "UNKNOWN - SSH connection failed or command rejected on ${HOST}"
  exit 2
}
if ! printf '%s' "$WV" | grep -qiE '^[[:space:]]*enable[[:space:]]'; then
  echo "PATCHED - SSL VPN (webvpn) is not enabled on any interface"
  exit 0
fi
echo "[+] SSL VPN is enabled"

# Step 2: Check for secondary authentication on any tunnel group
TG=$(rcmd "show running-config tunnel-group") || {
  echo "UNKNOWN - Cannot retrieve tunnel-group configuration from ${HOST}"
  exit 2
}
if ! printf '%s' "$TG" | grep -qi 'secondary-authentication-server-group'; then
  echo "PATCHED - No tunnel group uses secondary authentication; CVE-2026-76418 prerequisite not met"
  exit 0
fi
echo "[!] Secondary authentication configured on tunnel group(s):"
printf '%s\n' "$TG" | grep -i 'secondary-authentication-server-group' | sed 's/^/    /'

# Step 3: Print version for manual comparison against fixed releases
VER=$(rcmd "show version" | grep -iE 'software version|cisco adaptive|firepower threat' | head -3)
echo ""
echo "[i] Device version info:"
echo "    ${VER:-Could not determine version}"
echo ""
echo "Fixed ASA: 9.16.4(104) | 9.18.4(96) | 9.20.4(50) | 9.22.3(200) | 9.23.1(48) | 9.24.1(27)"
echo "Fixed FTD: 7.0.11 | 7.2.13 | 7.4.9 | 7.6.7 | 7.7.14 | 10.0.3 | 10.1.1"
echo ""
echo "VULNERABLE - ${HOST} has SSL VPN enabled with secondary authentication on at"
echo "  least one tunnel group. Verify version against fixed releases above."
echo "  Ref: cisco-sa-asaftd-tunnel-dos-s6mgkb75"
exit 1