Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

A critical vulnerability (CVE-2026-76418) exists in Cisco Secure Firewall ASA Software and Cisco Secure FTD Software involving an unchecked return value leading to a NULL pointer dereference. An unauthenticated, remote attacker can exploit this flaw to cause the affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is related to tunnel processing functionality. CISA has flagged this under BOD 26-04, requiring prioritized security updates based on risk. Forensic triage requirements have also been outlined under BOD 26-04 implementation guidance. The issue is documented in Cisco's Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 and tracked in the NVD. Organizations using Cisco ASA or FTD software should apply available patches immediately given the high criticality rating.