ZeroDayAlert

CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Added to KEV 2026-10-29 Federal due 2026-11-01 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software are vulnerable to a denial-of-service condition triggered by an unchecked NULL pointer dereference. An unauthenticated, remote attacker can cause an affected device to reload unexpectedly. The record does not specify which versions are affected or whether particular deployment models (standalone, clustered, cloud-hosted) carry different risk.

How to check whether this touches you

  • Inventory your network perimeter for Cisco ASA and FTD appliances, including model, software release, and management ownership.
  • Confirm whether each device is reachable without authentication from untrusted networks (WAN, internet-facing interfaces, or guest VLANs).
  • Obtain the running software version from the device's show version output or administrative console; version strings alone do not confirm whether mitigations have been applied, as Cisco may backport fixes to older releases.
  • Check Cisco's security advisory for CVE-2026-76418 to cross-reference your versions against the affected and remediated release list.

What to do

  1. Immediately check Cisco's advisory for CVE-2026-76418 and confirm which software versions are affected and which contain the fix.
  2. If you cannot patch within the federal remediation due date of 2026-11-01, implement network controls to restrict access to management interfaces and monitor for unexpected device reloads (syslog entries indicating reload events or loss of connectivity).
  3. Enable syslog forwarding to a remote server so that reload events and any preceding error messages are retained off-device; local logs are lost when the device reloads.
  4. If the appliance is internet-facing and patching is delayed, evaluate whether temporary network segmentation (access control lists, firewall rules upstream of the ASA/FTD) can reduce exposure to unauthenticated remote traffic.
  5. Escalate to your vendor relationship and security team if no remediation is available by the due date, or if the appliance performs a critical security or availability function and downtime is operationally unacceptable.

If you find you were exposed

Unexpected device reloads prior to your patch date are a potential exploitation signal. Search syslog archives and centralized logging systems for reload events, crash dumps, or NULL pointer dereference errors in the weeks before you apply the fix. Log retention is typically the limiting factor; most organisations retain 30–90 days of syslog history. If logs have been purged, document the gap and flag it in your incident timeline.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-76418 is being exploited. It cannot tell you whether Secure Firewall ASA Software and Cisco Secure FTD Software is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →