EUVD-2026-112462
GHSA-3whv-82g3-5cwx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach internet-facing SSL VPN endpoint
-
DeliverySend crafted connection request to secondary-auth tunnel group
-
ExploitTrigger logic error in authentication handling
-
ExecutionDevice reloads
-
ImpactDenial of service on firewall
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires the target ASA/FTD device to have the Remote Access SSL VPN service enabled AND secondary authentication configured on a tunnel group - this is the exact, named precondition from the description and is not a default configuration, so deployments without secondary authentication on a tunnel group are not affected. Given CVSS PR:N/UI:N/AV:N, no authentication, credentials, or user interaction are needed once that configuration is present; the attacker only needs network reachability to the SSL VPN listener. The principal limiting factors are therefore the non-default secondary-authentication configuration and network exposure of the VPN endpoint; the exact crafted-request structure that triggers the reload is not detailed in the available sources. |
| Impact | This is a genuine prioritization concern rather than a CVSS-inflated non-issue, but its real-world reach is gated by configuration. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, 8.6 High) describes a network-reachable, unauthenticated, low-complexity attack with no user interaction and scope change, impacting availability only - consistent with a crash/reload DoS on an internet-facing VPN edge device. The input provides no EPSS score, no CISA KEV listing, and no POC or exploit reference, so exploitation likelihood cannot be quantified from probabilistic signals; the only exploitation-maturity signal is Cisco PSIRT's own advisory and the vuln.today Decision label of 'this_week'. The critical mitigating fact, stated in the description, is that the flaw only manifests when secondary authentication is configured on a tunnel group - so the raw PR:N/AC:L vector overstates exposure for the large population of ASA/FTD deployments that do not use secondary authentication. No SSVC decision framework fields (automatable, technical impact, exploitation status) were supplied, so those cannot be cross-referenced. Net: treat as a time-boxed ('this week') patching priority for internet-facing ASA/FTD VPN headends that use secondary authentication; for deployments without secondary authentication the practical risk is substantially lower. |
| Exploit ScenarioDerived | An unauthenticated remote attacker reachable at an internet-facing ASA/FTD SSL remote-access VPN endpoint sends a crafted request during the SSL VPN connection handshake to a tunnel group that has secondary authentication configured. Logic errors (CWE-690, unchecked/mishandled return value) during that flow cause the device to reload, dropping all VPN sessions and traffic through the firewall. No public exploit code or PoC reference is present in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Unauthenticated remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software when the Remote Access SSL VPN service is enabled and secondary authentication is configured on a tunnel group. A crafted request sent while connecting to the SSL remote access VPN triggers logic errors in secondary authentication handling that force the device to reload, disrupting all traffic through the firewall. The CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H); no public exploit code or confirmed active exploitation is identified at time of analysis, and exposure is gated by the non-default secondary-authentication configuration plus network reachability to the VPN listener.
RemediationAI
Consult Cisco's advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75 for the exact fixed ASA and FTD releases for each version branch; the provided data does not list specific fixed version numbers, so upgrade to the release Cisco designates as fixed for your branch rather than assuming a version. For devices that cannot be upgraded promptly, the configuration precondition is the practical control: where operationally feasible, remove secondary authentication from tunnel groups (or disable the Remote Access SSL VPN service entirely) to eliminate the vulnerable code path, accepting the loss of the additional authentication factor or remote-access connectivity this entails. Restricting network reachability to the SSL VPN listener to known client populations reduces exposure but does not remove the flaw, and Cisco's advisory should be treated as the authoritative source for any vendor-stated workaround.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw (CWE-690, unchecked return value to NULL pointer dereference) resides in the SSL VPN remote access path of Cisco ASA and FTD, specifically in the logic handling secondary authentication (often used with double-authentication, AAA or certificate-plus-AAA flows) configured on a tunnel group. Per the advisory, logic errors in that flow can be reached by an unauthenticated connection before the VPN session is fully established; the resulting failure dereferences an unexpected NULL and crashes the process managing the VPN, reloading the device. The trigger structure of the crafted request is not described in the available sources. Because the vulnerable component is the remote-access VPN terminator itself, a successful reload takes down all firewall/VPN services on the appliance, not just the VPN session - reflected by the Scope:Changed metric. Only configurations with a tunnel group bound to secondary authentication are affected; default SSL VPN deployments without that setting are not.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Unauthenticated network attacker crafts a VPN request with no user interaction (AV:N/AC:L/PR:N/UI:N); device-wide reload warrants S:C with availability-only impact (C:N/I:N/A:H).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Executive ViewAI
Cisco ASA and FTD firewalls that expose Remote Access SSL VPN with secondary authentication are vulnerable to an unauthenticated denial-of-service condition (CVE-2026-76418). A single crafted request can force the appliance to reload, causing a full outage of all traffic traversing the firewall-impacting every business service, remote worker, and site-to-site link behind that perimeter. Leadership should care because perimeter firewalls are single points of failure: a sustained attack could repeatedly take down network connectivity, and no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: disable secondary authentication on SSL VPN tunnel groups or disable Remote Access SSL VPN entirely where business requirements permit; restrict VPN listener access to trusted IP ranges or geographies; apply connection rate limiting; monitor for anomalous SSL VPN traffic and unexpected device reloads; prepare failover and recovery runbooks to minimize outage duration.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB