Detect Cisco ASA/FTD Remote Access SSL VPN Unexpected Reload Denial of Service (CVE-2026-76418) in Microsoft Sentinel
Detects exploitation of CVE-2026-76418, an unchecked return value leading to NULL pointer dereference (CWE-690) in the Remote Access SSL VPN service of Cisco Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software. An unauthenticated remote attacker can send crafted requests to a tunnel group that has secondary authentication configured and make the device reload unexpectedly. The CVE is on the CISA KEV catalog (added 2026-10-29, BOD 26-04). Detection focuses on what the firewall and its log pipeline can show: unexpected reload, traceback or crash messages shortly after bursts of unauthenticated WebVPN connections, repeated device restarts in a short window, and a single external source hammering the SSL VPN portal before an outage.
MITRE ATT&CK
- Tactic
- Impact
KQL Detection Query
// df00tech DF00-a7d89fc7d5 · https://df00tech.com/detections/CVE-2026-76418 · licence: https://df00tech.com/detections/licence
let lookback = 24h;
Syslog
| where TimeGenerated >= ago(lookback)
| where SyslogMessage has_any ("%ASA-", "%FTD-")
| where SyslogMessage has_any ("Reload", "reload", "traceback", "Traceback", "crashinfo", "System restart")
| extend Signal = case(
SyslogMessage has_any ("traceback", "Traceback", "crashinfo"), "CrashTraceback",
SyslogMessage has_any ("Reload", "reload", "System restart"), "UnexpectedReload",
"Other")
| summarize Events = count(), Signals = make_set(Signal), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Sample = take_any(SyslogMessage) by Computer
| where Signals has_any ("CrashTraceback", "UnexpectedReload")
| order by LastSeen descFlags Cisco ASA or FTD syslog showing crash tracebacks or unexpected reloads, the observable outcome of the SSL VPN denial of service in CVE-2026-76418.
Data Sources
Required Tables
False Positives & Tuning
- Planned reloads during maintenance windows or software upgrades
- Hardware or failover events that reboot a firewall unrelated to VPN traffic
- Scanners or load tests that hit the WebVPN endpoint
Other platforms for CVE-2026-76418
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are further down this page.
- Test 1 Emit a stand-in firewall restart message to syslog (lab)
Expected signal: A syslog event containing %ASA-, traceback and System restart.
Response Playbook
Triage
- Confirm the device runs an affected ASA or FTD build and has Remote Access SSL VPN with secondary authentication on a tunnel group, per the Cisco advisory.
- Identify the device, the reload time, and any burst of unauthenticated WebVPN connections from one or a few external sources beforehand.
- Check whether the reload matches a planned change, upgrade or HA failover.
Containment
- Upgrade to a fixed ASA or FTD release listed in the Cisco advisory, and follow BOD 26-04 guidance.
- Until patched, restrict SSL VPN exposure to known source ranges or disable secondary authentication on exposed tunnel groups where policy permits.
- Rate-limit or block the offending sources at the upstream edge.
Evidence Collection
- Collect the crashinfo and traceback files from the device before further reloads.
- Export firewall syslog, VPN session logs and threat-detection output for the window around each reload.
- Preserve upstream proxy, load balancer and flow logs for the same sources.
Escalation Criteria
- !Escalate to incident response on repeated unexplained reloads or when the VPN is unavailable.
- !Escalate if reloads coincide with other KEV Cisco or edge-device alerts, which can indicate a chained attack.
- !Escalate if both units of a failover pair go down together.
Investigation Guide
Forensic Artifacts
- >
ASA or FTD crashinfo and traceback files - >
Firewall syslog around each reload - >
VPN tunnel-group configuration showing secondary authentication
Tuning Guidance
Exploitation leaves little beyond a crash, so treat these rules as medium or low fidelity. Baseline planned reloads per device, suppress change-managed windows and HA failovers, and prioritise alerts where a burst of unauthenticated WebVPN connections from one source precedes the reload. Patching is the definitive fix.
Hunting Queries
Builds a daily per-firewall count of reload and traceback messages so unusual restarts stand out after the 2026-10-28 disclosure.
// df00tech DF00-a7d89fc7d5 · https://df00tech.com/detections/CVE-2026-76418 · licence: https://df00tech.com/detections/licence
Syslog | where TimeGenerated > ago(14d) | where SyslogMessage has_any ("%ASA-", "%FTD-") | where SyslogMessage has_any ("Reload", "traceback", "System restart") | summarize Reloads = count() by Computer, bin(TimeGenerated, 1d) | order by Computer asc, TimeGenerated asc``` df00tech DF00-a7d89fc7d5 · https://df00tech.com/detections/CVE-2026-76418 · licence: https://df00tech.com/detections/licence ```
index=network ("%ASA-" OR "%FTD-") (reload OR traceback OR "System restart") earliest=-14d | timechart span=1d count by hostAtomic Red Team Tests
Simulates the telemetry the log rules key on by writing an ASA-style restart message to the local syslog on a Linux lab host. This does not exploit the vulnerability. Run only on a lab host.
Command
logger -t asa "%ASA-1-199010: Signal 11 received, System restart traceback test"Cleanup
echo "no cleanup required"Expected Telemetry
A syslog event containing %ASA-, traceback and System restart.
Expected Detection
The KQL, SPL and Sumo rules match on the message text; this test exercises the field mapping only.