What happened
CVE-2026-76418 (added to CISA KEV 2026-10-29): a logic error in the Remote Access SSL VPN service when secondary authentication is configured on a tunnel group causes an unchecked return value to a NULL pointer dereference (CWE-690). An unauthenticated remote attacker sends a crafted request when connecting to the SSL remote access VPN, causing the ASA/FTD device to reload unexpectedly — a denial-of-service condition. Confirmed in-the-wild.
Why it matters
This is a network-security appliance flaw (explicitly outside the AI-relevance core of the in-scope list) that is retained because KEV confirms in-the-wild exploitation and the ASA/FTD often fronts remote access into cloud/AI environments. A remotely triggerable reload is a DoS on the path to AI/cloud resources. Weak direct AI relevance; strong operational signal.
Attack vector
An unauthenticated attacker sends a crafted SSL remote-access VPN reconnect/connect request when secondary authentication is configured, triggering a NULL pointer dereference and an unexpected device reload.
Affected systems
Cisco Secure Firewall ASA/FTD Software (e.g. 9.16.x, 9.18.x, 9.19.x, 9.20.x, 9.22.x, 9.23.x, 9.24.x) with SSL remote-access VPN + secondary auth.
Mitigation
Apply the Cisco advisory (cisco-sa-asaftd-tunnel-dos-s6mgkb75) mitigation/upgrade; follow CISA BOD 26-04 guidance for network devices.