What is CVE-2026-76418?

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

CISA added this issue to its exploited-vulnerability catalog on 2026-10-29. This is the catalog date, not this article’s publication date.

Sources: CISA Known Exploited Vulnerabilities catalog, CVE-2026-76418 — NVD

First, confirm where the vulnerable product is running

CVE-2026-76418 describes a NULL pointer dereference in Cisco Secure Firewall ASA and FTD Software that allows an unauthenticated, remote attacker to trigger an unexpected reload, causing denial of service. The CISA catalog entry lists no fixed versions and explicitly states that cloud deployment support and managed cloud service exposure are not established. Remediation must follow Cisco's vendor advisory and supported upgrade path for these appliances. Do not attempt to patch via host OS tools or install agents on the appliances; Cisco controls the firmware/software image lifecycle. For any customer-managed instances running in cloud environments (e.g., VM-series or BYOL deployments), apply the vendor-provided upgrade and verify service restoration. If no vendor fix exists, follow BOD 26-04 guidance for compensating controls or product discontinuation.

The named vulnerable product is Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. Deployment on a cloud platform does not by itself establish that a managed AWS, Azure or GCP service is vulnerable. Confirm the product, version, vendor-supported deployment and remediation owner.

Vendor remediation comes first

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Use the current vendor advisory for affected versions and fixed builds. This catalog entry does not establish a universal fixed version or a cloud-specific hotfix.

Sources: CISA Known Exploited Vulnerabilities catalog, CVE-2026-76418 — NVD

AWS: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. Identify any customer-managed Cisco Secure Firewall/FTD instances (e.g., BYOL AMIs, EC2-hosted virtual appliances) in your AWS inventory; managed services (e.g., AWS Network Firewall) are not established as affected.
  2. Obtain the fixed software image directly from Cisco and apply it using Cisco's supported upgrade procedure for the appliance; AWS Systems Manager Patch Manager does not update vendor appliance firmware.
  3. Verify the upgrade completed successfully via Cisco CLI/ASDM and confirm the device no longer reloads under the trigger conditions described in the advisory.
  4. If no vendor fix is available, implement network-level mitigations (e.g., restrict management/control-plane access via Security Groups/NACLs) and document the residual risk per BOD 26-04.

Sources: AWS Systems Manager Patch Manager

Azure: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. Inventory customer-managed Cisco Secure Firewall/FTD virtual appliances deployed on Azure VMs or via Azure Marketplace BYOL; Azure-managed network security services are not established as affected.
  2. Apply the Cisco-provided software upgrade using the vendor's documented upgrade path; Azure Update Manager patches the underlying OS only, not the appliance application firmware.
  3. Post-upgrade, verify appliance health via Cisco management interfaces (ASDM/CLI) and validate that traffic processing is stable.
  4. Where a fix is unavailable, restrict inbound access to vulnerable interfaces using NSGs and Azure Firewall policies, and record the compensating controls for BOD 26-04 compliance.

Sources: Azure Update Manager overview

GCP: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. Locate any customer-managed Cisco Secure Firewall/FTD instances running on Compute Engine (BYOL images or manual installs); Google Cloud managed firewall services are not established as affected.
  2. Upgrade using the Cisco-supplied image and documented procedure; VM Manager Patch manages OS packages only and does not update appliance firmware.
  3. Confirm the upgrade via Cisco CLI/ASDM and monitor for unexpected reloads to verify the DoS vector is mitigated.
  4. If no patch exists, enforce VPC firewall rules to limit exposure of vulnerable interfaces and document the risk acceptance per BOD 26-04.

Sources: Google Cloud VM Manager — About Patch

How to verify the fix

  1. Confirm the running software version matches the Cisco advisory's fixed release via 'show version' or ASDM.
  2. Validate that the appliance processes expected traffic without reload for a sustained period post-upgrade.
  3. Review device logs for any recurrence of the NULL pointer dereference signature or unexpected reload events.
  4. Ensure configuration backups and rollback plans were captured before the upgrade.

Questions teams ask

Can I use AWS Systems Manager Patch Manager / Azure Update Manager / GCP VM Manager Patch to fix this vulnerability on my Cisco firewall appliance?

No. These services manage operating-system packages on compute instances. Cisco Secure Firewall ASA and FTD are vendor appliances with proprietary firmware/software images. Only Cisco's supported upgrade procedure applies; host-level patch tools cannot update the appliance software.

Is Cisco Secure Firewall available as a managed cloud service on AWS/Azure/GCP, and is that service affected?

The CISA catalog entry states managed cloud service exposure is not established. AWS Network Firewall, Azure Firewall, and Google Cloud Firewall are distinct managed services; do not assume they share this vulnerability. Applicability for any third-party managed service must be confirmed by that provider.

What if Cisco has not yet released a fixed version for my appliance model?

Follow CISA BOD 26-04 guidance: assess internet exposure, implement compensating controls (restrict management/control-plane access, enable intrusion prevention signatures if available), monitor for exploitation, and plan for product replacement if a fix is not forthcoming. The catalog entry lists fixed versions as 'Not established'; verify the latest status in the linked Cisco advisory.

How do I verify the fix worked without vendor-provided exploit code?

Upgrade to the version Cisco identifies as fixed, then monitor device stability: check 'show version' for the new release, watch syslogs for unexpected reloads, and confirm sustained traffic processing. Absence of the reload symptom under normal and peak load is the practical verification; a patch does not prove there was no earlier compromise.

Sources & further reading

This brief summarizes public source material. Confirm affected versions and the current vendor instructions before changing production. No original exploit validation is claimed.