Cisco ASA/FTD Remote Access SSL VPN Unexpected Reload Denial of Service (CVE-2026-76418)

// df00tech DF00-a7d89fc7d5 · https://df00tech.com/detections/CVE-2026-76418 · licence: https://df00tech.com/detections/licence
let lookback = 24h;
Syslog
| where TimeGenerated >= ago(lookback)
| where SyslogMessage has_any ("%ASA-", "%FTD-")
| where SyslogMessage has_any ("Reload", "reload", "traceback", "Traceback", "crashinfo", "System restart")
| extend Signal = case(
    SyslogMessage has_any ("traceback", "Traceback", "crashinfo"), "CrashTraceback",
    SyslogMessage has_any ("Reload", "reload", "System restart"), "UnexpectedReload",
    "Other")
| summarize Events = count(), Signals = make_set(Signal), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Sample = take_any(SyslogMessage) by Computer
| where Signals has_any ("CrashTraceback", "UnexpectedReload")
| order by LastSeen desc

``` df00tech DF00-a7d89fc7d5 · https://df00tech.com/detections/CVE-2026-76418 · licence: https://df00tech.com/detections/licence ```
index=network (sourcetype="cisco:asa" OR sourcetype="cisco:ftd" OR sourcetype="syslog") ("%ASA-" OR "%FTD-") (reload OR traceback OR crashinfo OR "System restart") earliest=-24h
| eval signal=case(match(_raw, "(?i)(traceback|crashinfo)"), "CrashTraceback", match(_raw, "(?i)(reload|system restart)"), "UnexpectedReload", true(), null())
| where isnotnull(signal)
| stats count AS events values(signal) AS signals latest(_time) AS lastSeen earliest(_time) AS firstSeen BY host
| convert ctime(firstSeen) ctime(lastSeen)
| sort - lastSeen

// df00tech DF00-a7d89fc7d5 · https://df00tech.com/detections/CVE-2026-76418 · licence: https://df00tech.com/detections/licence
any where event.dataset in ("cisco_asa.log", "cisco_ftd.log") and message : ("*traceback*", "*crashinfo*", "*System restart*", "*Reload*")

-- df00tech DF00-a7d89fc7d5 · https://df00tech.com/detections/CVE-2026-76418 · licence: https://df00tech.com/detections/licence
SELECT sourceip, QIDNAME(qid) AS event_name, UTF8(payload) AS raw, DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS event_time FROM events WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%cisco%' AND (UTF8(payload) ILIKE '%traceback%' OR UTF8(payload) ILIKE '%crashinfo%' OR UTF8(payload) ILIKE '%system restart%' OR UTF8(payload) ILIKE '%reload%') ORDER BY starttime DESC LAST 24 HOURS

// df00tech DF00-a7d89fc7d5 · https://df00tech.com/detections/CVE-2026-76418 · licence: https://df00tech.com/detections/licence
_sourceCategory=*cisco* OR _sourceCategory=*asa* OR _sourceCategory=*ftd*
| where _raw matches /(?i)(traceback|crashinfo|system restart|reload)/
| count by _sourceHost, _sourceCategory
| sort by _count desc

// df00tech DF00-a7d89fc7d5 · https://df00tech.com/detections/CVE-2026-76418 · licence: https://df00tech.com/detections/licence
rule cisco_asa_ftd_ssl_vpn_reload_cve_2026_76418 {
  meta:
    author = "Argus"
    description = "Cisco ASA or FTD crash or unexpected reload (CVE-2026-76418)"
    severity = "HIGH"
  events:
    $e.metadata.product_name = /ASA|FTD|Firepower|Secure Firewall/ nocase
    re.regex($e.metadata.description, `(traceback|crashinfo|system restart|reload)`) nocase
    $host = $e.principal.hostname
  match:
    $host over 1h
  condition:
    $e
}

// df00tech DF00-a7d89fc7d5 · https://df00tech.com/detections/CVE-2026-76418 · licence: https://df00tech.com/detections/licence
#repo=*firewall*
| message=/%(ASA|FTD)-/
| message=/(traceback|crashinfo|system restart|reload)/i
| table([@timestamp, host, message])