Cisco Patches Actively Exploited ASA and FTD Firewall Crash Vulnerability (CVE-2026-76418)

Scope: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software

Severity: Amber

CISA added CVE-2026-76418 to its Known Exploited Vulnerabilities catalog after Cisco confirmed active exploitation earlier this month. The flaw, rated 8.6 on CVSS, is an unchecked return value leading to a NULL pointer dereference that allows a completely unauthenticated remote attacker to force an affected ASA or FTD device to unexpectedly reload, resulting in a denial-of-service condition. Cisco has not publicly disclosed how many organisations have been targeted, who is behind the activity, or what attackers did once a device went down, which limits how much defenders can proactively hunt for this specific campaign beyond applying the patch. Because ASA and FTD devices sit at the network perimeter as firewalls, repeated unexpected reloads represent a real operational disruption on top of the underlying security exposure, and any organisation seeing unexplained firewall reload patterns should treat this CVE as a likely cause worth checking. Federal agencies were given until November 1, 2026 to apply fixes, a deadline that has now passed. Organisations running Cisco ASA or FTD must apply Cisco’s fix immediately, and should investigate any device exhibiting unexpected reload behaviour against this specific vulnerability.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.