Security Resilience

CVE-2026-76418

Cisco Adaptive Security Appliance Software ≤ 9.16.4.104

CISA KEVActive ExploitationEUVD Exploited
Published
28 October 2026
Modified
30 October 2026
KEV Added
29 October 2026
Patch / advisory
View advisory
CVSS Score v3.1 8.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EPSS Score 0.0082 57th percentile
Risk Priority 88 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-76418 is a high-severity Unchecked Return Value to NULL Pointer Dereference (CWE-690) vulnerability in Cisco Adaptive Security Appliance Software. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked in the top 43% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting…

more

in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

CWE(s)
CWE-690
KEV Date Added
29 October 2026

Related Threats

MITRE ATT&CK Enterprise Techniques

MITRE ATT&CK v20.0

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1687 Exploitation for Defense Impairment Defense Impairment
Adversaries may exploit vulnerabilities in security software, infrastructure, or defensive components to degrade, disable, or otherwise continue to impair their ability to prevent, detect, or respond to malicious activity.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-20269Same product: Cisco Adaptive Security Appliance Softwareboth on KEV
CVE-2024-20359Same product: Cisco Adaptive Security Appliance Softwareboth on KEV
CVE-2024-20353Same product: Cisco Adaptive Security Appliance Softwareboth on KEV
CVE-2024-20481Same product: Cisco Adaptive Security Appliance Softwareboth on KEV
CVE-2026-20349Same product: Cisco Adaptive Security Appliance Softwareboth on KEV
CVE-2025-20333Same product: Cisco Adaptive Security Appliance Softwareboth on KEV
CVE-2020-3580Same product: Cisco Adaptive Security Appliance Softwareboth on KEV
CVE-2018-0296Same product: Cisco Adaptive Security Appliance Softwareboth on KEV
CVE-2026-20014Same product: Cisco Adaptive Security Appliance Software
CVE-2026-20016Same product: Cisco Adaptive Security Appliance Software

Affected Assets

cisco
adaptive security appliance software
9.24.10 · ≤ 9.16.4.104 · 9.18 — 9.18.4.96 · 9.19 — 9.20.4.50
cisco
secure firewall threat defense
10.1.0 · ≤ 7.0.11 · 7.2.0 — 7.2.13 · 7.3.0 — 7.4.9

Mitigating Controls

Mitigating Controls (NIST 800-53 r5)

Our mappings, made for this CVE.

SA-11 Developer Testing and Evaluation partial match

Developer testing and evaluation can discover missing NULL checks on function returns that may dereference.

SA-15 Development Process, Standards, and Tools partial match

Requiring documented development standards and tools can enforce mandatory error-return checking before dereference.

Mitigating Controls (NIST CSF 2.0)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.

PR.PS-06 mostly match
blocks

Secure SDLC practices directly include static analysis, code review, and error-handling standards that prevent unchecked return values.

Mitigating Controls (ISO/IEC 27001:2022 Annex A)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing in development can detect missing NULL checks before release.

A.8.28 Secure coding partial match
prevents

Secure coding standards explicitly forbid unchecked return values leading to NULL dereference.

References