Cisco ASA and FTD: actively exploited flaw lets attackers reload firewalls (CVE-2026-76418)

What happened

Cisco disclosed a vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software on 28 October 2026. It is tracked as CVE-2026-76418 and has a CVSS base score of 8.6.

The cause is an unchecked return value that leads to a NULL pointer dereference. An unauthenticated, remote attacker can exploit it to make the device reload unexpectedly. This causes a denial of service (DoS) condition.

On 29 October 2026, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog. That means attacks are already happening.

Who is affected

You are affected if you run Cisco Secure Firewall ASA Software or Cisco Secure FTD Software. This includes firewalls that protect hosting environments, server racks, office networks or customer infrastructure. The source data does not list the affected and fixed versions. Check the Cisco advisory linked below to see which releases are vulnerable and which ones contain the fix.

While a firewall reloads, traffic through it stops. Websites, mail servers and VPN access behind the device become unreachable. Repeated attacks can keep the device down for long periods.

What to do now

1. List every Cisco ASA and FTD device you or your customers operate. Note the software version of each one.
2. Open the Cisco security advisory linked below. Use it to find out whether your versions are affected and which fixed release applies to your train.
3. Back up the running configuration of each device before you change anything.
4. Upgrade to the fixed release Cisco names for your version. For FTD, do this through your management center or device manager as usual.
5. After the upgrade, check the following:
   • the device runs the new version
   • interfaces, VPN tunnels and failover are working
   • the services behind the firewall are reachable
6. If you cannot upgrade right away, apply any mitigations or workarounds the Cisco advisory describes. Also limit exposure of the affected services to the internet where possible.
7. Plan the upgrade for HA pairs and clusters so that one unit keeps passing traffic while the other is updated.

How to check whether you are affected

• Compare the version shown by show version with the affected releases listed in the Cisco advisory.
• Look for unexpected reloads since 28 October 2026. You can check this in three places:
  • the uptime and last reload reason in show version
  • crash information on the device
  • your syslog or monitoring history for outages of the firewall or the services behind it
• If you find unexplained reloads, keep the crash information and logs. Contact Cisco TAC to confirm whether they are related to this vulnerability.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-76418
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog