How to Plan a Cisco ASA or FTD Upgrade for CVE-2026-76418

A Cisco ASA or FTD upgrade for CVE-2026-76418 with minimal VPN downtime starts with the right target release from Cisco's fixed-release table or Software Checker, a compatibility check against your hardware and management version, and a configuration backup. On a failover pair, upgrade the standby unit first so one unit keeps passing traffic. Plan validation and rollback before the window, and warn remote users that VPN sessions may need to reconnect.

The news report on CVE-2026-76418 covers the flaw and its exploitation. Run the exposure audit first so you know which devices need the upgrade and in what order. This guide covers planning the change itself.

Pick the target release for each upgrade

Cisco's first fixed releases are:

• ASA 9.16 and earlier: 9.16.4.104
• ASA 9.18: 9.18.4.96
• ASA 9.20: 9.20.4.50
• ASA 9.22: 9.22.3.200
• ASA 9.23: 9.23.1.48
• ASA 9.24: 9.24.1.27 or 9.24.10.1
• FTD 7.0 and earlier: 7.0.11
• FTD 7.2: 7.2.13
• FTD 7.4: 7.4.9
• FTD 7.6: 7.6.7
• FTD 7.7: 7.7.14
• FTD 10.0: 10.0.3
• FTD 10.1: 10.1.1

The CVE record also lists ASA 9.19 and FTD 7.3 builds as affected, but Cisco's tables have no row for those trains. If you run either, do not guess a fixed build. Use the Cisco Software Checker to find a fixed release on a supported train, and expect that to be a train change rather than a maintenance update. Our note on why firmware release trains matter for patching covers that planning problem.

A first fixed release is a minimum. Cisco points customers to its Recommended Releases documents for choosing a release, and says that if a security advisory recommends a later release, follow the advisory.

How do you use the Cisco Software Checker for CVE-2026-76418?

Choose which advisories to search, select ASA or FTD software and your platform, enter the exact running release, and click Check. The result gives the First Fixed release for each matching advisory and, where applicable, a Combined First Fixed release that fixes all of them.

Run it for "only this advisory" to confirm CVE-2026-76418 coverage, then for "all Critical and High advisories". If you are taking a maintenance window anyway, the Combined First Fixed result tells you whether one target release can also close other advisories against the same version.

Check model and management compatibility

Before you schedule anything, confirm the target release runs on your hardware and works with what manages it:

• Platform support: check the Cisco Secure Firewall ASA Compatibility guide or the Threat Defense Compatibility Guide, both linked from the advisory, for your model and target release.
• Management version: Cisco's procedure for FTD high availability managed by FMC says to ensure the FMC version is higher than or equal to the new FTD version. If the FMC is behind, it has to be upgraded first, which is a separate change.
• Bundled software: on Secure Firewall 1000, 2100, 3100 and 4200 appliances running ASA, Cisco says ASA and FXOS are bundled and cannot be installed separately.
• Clients and integrations: check the release notes for changes affecting the remote access VPN client versions, authentication servers and any secondary authentication provider your tunnel groups use.

Back up and record the current state

Take and store, off the device, a copy of the current running configuration and any certificates and keys the VPN depends on, using your normal backup method for ASA, FMC or FDM. Record the running release, the failover state, and a baseline of normal VPN session counts. That baseline is what you compare against after the upgrade.

How do you upgrade a failover pair with minimal VPN downtime?

Upgrade the standby unit first, fail over to it, then upgrade the other unit. Cisco's documentation says this keeps one device active throughout and minimises service interruption, but it does not promise zero interruption.

For an ASA active/standby pair managed from the CLI, Cisco's procedure is to load the new image on both units, set it as the boot image and save the configuration, reload the standby with failover reload-standby, make the primary unit standby with no failover active, and then reload the new standby. Cisco verifies the result with show failover, checking that both units report the new version.

For FTD high availability managed by FMC, Cisco says FMC upgrades one peer at a time and that a failover occurs automatically as part of the upgrade. Its readiness check covers disk space, NTP synchronisation, version compatibility, FXOS and platform compatibility, HA and cluster health, and pending configuration. Run it, resolve every failure, and deploy pending changes before the window, not during it.

A standalone device has no partner to carry traffic, so its reload is an outage. Schedule it as one.

Maintenance communication

Tell remote users the date, the time window in their time zone, and what to expect: a short disconnect at failover, or a longer outage on a standalone unit. Give them a reconnect instruction and a way to report problems. Tell your service desk which secondary authentication flow to test if users report login failures afterwards, and set a go or no-go decision point before the window starts.

Validation after the upgrade

• Confirm the version on every unit: show failover on ASA, or Devices, then Device Management in FMC.
• Confirm failover health: Cisco's FTD procedure expects Primary Active and Secondary Standby Ready with both units on the new version.
• On FTD, deploy policy to the pair and confirm it completes.
• Test VPN logins on every tunnel group that uses secondary authentication, from outside the network.
• Compare session counts against your baseline.
• If you used Cisco's temporary mitigation and removed secondary authentication, restore it now and test it.
• Watch for unexpected reloads in the following days.

Rollback plan

Decide your rollback criteria before the window: failed logins on a named tunnel group, failover not returning to a healthy state, or an outage longer than your stated window. Cisco's ASA upgrade guide has a section on downgrading the ASA. For FTD, check the FMC upgrade guide for your version to see which revert or downgrade options it supports for your path. Read the one that applies before the window, keep the previous image available, and keep the pre-upgrade configuration backup.

Remember that rolling back puts the device on a vulnerable release again. If you roll back, decide straight away whether to apply Cisco's mitigation, with its documented costs, until a second attempt.

What if you cannot upgrade before November 1?

Cisco offers a mitigation but calls it temporary, and one version of it removes secondary authentication from the VPN. If you use it, record it as a change with an expiry date and keep the upgrade scheduled.

The KEV entry's due date is November 1, 2026, and its required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Treat the mitigation as time bought for the upgrade, not a substitute for it.

Sources

• Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75
• CISA Known Exploited Vulnerabilities catalog
• CVE-2026-76418 record on CVE.org
• Cisco Software Checker
• Cisco: Upgrade ASA Active/Standby Failover Pair for the Secure Firewall
• Cisco: Upgrade FTD HA Managed by FMC
• Cisco Security Cloud Control: Workflow for upgrading an ASA high availability pair