Skip to content
VulniPulse
Sign in
Highest advisory severityHigh Exploited CISA KEV 1 vendor · 1 advisory

CVE-2026-76418

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Get an email when Cisco publishes the next one.

See Cisco's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Cisco

CVE-2026-76418 key facts

CISA KEV
Listed on · federal remediation due
Highest advisory severity
High
CVSS base score
8.6 (Cisco)
Fixed releases
  • Cisco: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 7 more in the advisory
Vendor advisories
1 from Cisco
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-76418; bulletin-wide values are not repeated here.

Is CVE-2026-76418 exploited?

Yes. CISA lists CVE-2026-76418 in its Known Exploited Vulnerabilities catalog (added ), which means CISA has evidence of exploitation in the wild.

How do I fix CVE-2026-76418?

Upgrade to a fixed release named by the vendor:

  • Cisco: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27
  • Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory. (Cisco)
  • Release 9.16 and earlier: upgrade to 9.16.4.104. (Cisco)

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor advisory comparison

Cisco

1 advisory
  • Advisory severityHigh8.6

    High [CVE-2026-76418] Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

    cisco-sa-asaftd-tunnel-dos-s6mgkb75Source published Source updated

    A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

    Affected products in this advisory
    • Secure Firewall Adaptive Security Appliance (ASA) Software
    • Firepower 2100 Series
    • Firepower 1000 Series
    • ASA 5500-X Series Firewalls

    4 more entries in the full advisory.

    Source-reported affected versions
    • Release 9.16 and earlier (first fixed: 9.16.4.104)
    • Release 9.18 (first fixed: 9.18.4.96)
    • Release 9.20 (first fixed: 9.20.4.50)
    • Release 9.22 (first fixed: 9.22.3.200)

    9 more entries in the full advisory.

    Source-reported fixed versions
    • 9.16.4.104
    • 9.18.4.96
    • 9.20.4.50
    • 9.22.3.200

    9 more entries in the full advisory.

    Mitigation guidance
    • Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
    • Release 9.16 and earlier: upgrade to 9.16.4.104.
    • Release 9.18: upgrade to 9.18.4.96.
    • Release 9.20: upgrade to 9.20.4.50.

    5 more entries in the full advisory.

    Workarounds
    • There are no workarounds that address this vulnerability. However, there is a mitigation, which is to disable secondary authentication on any user-configured tunnel group list or on the default tunnel group, DefaultWEBVPNGroup.
    • Case 1: If DefaultWEBVPNGroup does not use secondary authentication, disable the tunnel group list. In WebVPN configuration mode, enter no tunnel-group-list enable. With the tunnel group list disabled, users will no longer be able to choose a connection profile (the tunnel-group name) from a provided list and instead will need to know the correct profile to use.
    • Case 2: If DefaultWEBVPNGroup uses secondary authentication, use the no secondary-authentication-server-group CLI command to remove secondary authentication. With secondary authentication disabled, the security posture is lowered for remote access VPN.
    Full advisory and evidenceOpen source bulletin

More Cisco advisories

All Cisco advisories

Follow CVE-2026-76418 in the free weekly digest

Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.

Free, no account. Confirm by email; unsubscribe in one click. Choose vendors and severity

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Monitor future Cisco CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features