Cisco ASA/FTD SSL VPN DoS on KEV: secondary auth, reload, and what not to claim

On 29 Oct 2026, CISA added CVE-2026-76418 to the Known Exploited Vulnerabilities catalog: an unchecked return value → NULL pointer dereference in Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) Remote Access SSL VPN that can reload the device (DoS). Cisco’s advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 (28 Oct 2026) is the version matrix; Cisco PSIRT states active exploitation awareness in October 2026.

This is availability, not a free RCE finding. Unauthenticated attackers who can reach the SSL VPN login path may crash/reload the box when secondary authentication is configured on the relevant tunnel group. Same KEV day also listed a GitLab integer-overflow issue — do not conflate perimeter VPN DoS with forge RCE.

Use Cisco’s Software Checker / fixed-release tables for authoritative builds. This post is engagement sequencing.

Snapshot

Fixed trains (first fixed — verify on advisory)

ASA: 9.16.4.104; 9.18.4.96; 9.20.4.50; 9.22.3.200; 9.23.1.48; 9.24.1.27 / 9.24.10.1

FTD: 7.0.11; 7.2.13; 7.4.9; 7.6.7; 7.7.14; 10.0.3; 10.1.1

Why config beats “Cisco on the edge” mid-engagement

Internet-facing ASA/FTD SSL VPN portals are common ROE objects. On assessment:

• Finding AnyConnect / WebVPN login ≠ vulnerable. You need secondary-authentication-server-group on the reachable tunnel-group path (including DefaultWEBVPNGroup when the group list is disabled — Cisco calls this out explicitly)
• Successful VPN login is not required to hit the affected processing path
• Crashing a production VPN mid-test without authorization / change window is an engagement failure mode, not a flex

Industry noise says “Cisco zero-day.” Engagement state asks: SSL VPN enabled, secondary auth present, exact train, and whether DoS testing is in ROE.

Triage questions

1. In ROE? ASA/FTD (or managed FTD via FMC/FDM) remote-access VPN testing authorized — including disruptive DoS?
2. SSL VPN on? webvpn enable <iface> / FMC Remote Access VPN deployed?
3. Secondary auth? Tunnel groups (and default) for secondary-authentication-server-group per Cisco’s two cases?
4. Version? Against the fixed trains above — use show version / FMC inventory, not “ASA 9.x” as a brand.
5. What do you pause? Unfinished AD/web paths with evidence deserve a clean pause note; do not DoS the client’s only remote-access path as improvisation.

Operator path

Evidence worth capturing

• Product (ASA vs FTD), exact software version, and management path (FMC/FDM/local)
• Proof SSL VPN is enabled and which tunnel groups carry secondary authentication
• Change-window / ROE note if any reload testing was performed
• Post-patch version string; if mitigation used instead, document the posture tradeoff Cisco warns about

Client-facing remediations (short)

• Upgrade to a first-fixed release in the appropriate ASA/FTD train (table above / Software Checker)
• Until upgraded: evaluate Cisco’s secondary-auth / tunnel-group-list mitigations — they can reduce VPN security posture
• Restrict unnecessary internet exposure of the SSL VPN login surface
• After suspected exploitation of availability attacks: treat as ops/IR for reload loops and related edge abuse — this CVE’s stated impact is DoS, not code execution

What not to write

• “Unauthenticated RCE on ASA” — advisory impact is DoS / reload
• Treating every AnyConnect portal as vulnerable without the secondary-auth precondition
• Bundling cloud-delivered Cisco firewall SKUs Cisco lists as not affected
• Completeness claims (“all firewalls checked”) without inventory
• Invented post-exploitation or ransomware attribution from a DoS CVE alone

Primary sources: CISA KEV alert (29 Oct 2026) and Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75. Re-verify fixed versions there before you file.