Riskcovery

CVE-2026-76418

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

State
Published
Severity
8.6 High
Published
Oct 28, 2026
Updated
Oct 30, 2026
Reserved
Aug 19, 2026

Read the record on cve.org

Description

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

Scores

CVSSScoreVectorSource
3.18.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:Hcisco

Weaknesses

  • CWE-690 Unchecked Return Value to NULL Pointer Dereference

Affected Products

ProductVersions
Cisco Secure Firewall Adaptive Security Appliance (ASA) SoftwareCisco
  • 9.16.1Affected
  • 9.16.1.28Affected
  • 9.16.2Affected
  • 9.16.2.3Affected
  • 9.16.2.7Affected
  • 9.16.2.11Affected
  • 9.16.2.13Affected
  • 9.16.2.14Affected
  • 9.16.3.3Affected
  • 9.16.3Affected
  • 9.16.3.14Affected
  • 9.18.1Affected
  • 9.16.3.15Affected
  • 9.18.1.3Affected
  • 9.18.2Affected
  • 9.16.3.19Affected
  • 9.16.3.23Affected
  • 9.18.2.5Affected
  • 9.16.4Affected
  • 9.18.2.7Affected
  • 9.19.1Affected
  • 9.16.4.9Affected
  • 9.18.2.8Affected
  • 9.16.4.14Affected
  • 9.18.3Affected
  • and 117 more versions
Cisco Secure Firewall Threat Defense (FTD) SoftwareCisco
  • 7.0.0Affected
  • 7.0.0.1Affected
  • 7.0.1Affected
  • 7.0.1.1Affected
  • 7.0.2Affected
  • 7.2.0Affected
  • 7.0.2.1Affected
  • 7.0.3Affected
  • 7.2.0.1Affected
  • 7.0.4Affected
  • 7.2.1Affected
  • 7.0.5Affected
  • 7.3.0Affected
  • 7.2.2Affected
  • 7.2.3Affected
  • 7.3.1Affected
  • 7.2.4Affected
  • 7.0.6Affected
  • 7.2.5Affected
  • 7.2.4.1Affected
  • 7.3.1.1Affected
  • 7.4.0Affected
  • 7.0.6.1Affected
  • 7.2.5.1Affected
  • 7.4.1Affected
  • and 42 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.