Field Notice: FN74395 - Cisco Secure Firewall Threat Defense Software: VaultApp Process Might Cause Instability for Cisco Secure Firewall Devices - Software Upgrade Recommended

Available Languages

Updated:May 1, 2026
Document ID:FN74395

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Critical
Impact Rating:
Critical
First Published:
2026-May-01
Last Published:
2026-May-01
Revision:
1.0
Cisco Bug IDs:

Notice

THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.

Products Affected


Affected Software Product Affected Release Affected Release Number Comments
Firepower Threat Defense (FTD) Software 7 7.1.0, 7.1.0.1, 7.1.0.2, 7.1.0.3, 7.2.0, 7.2.0.1, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.4.1, 7.2.5, 7.2.5.1, 7.2.5.2, 7.2.6, 7.2.7, 7.2.8, 7.2.8.1, 7.2.9, 7.3.0, 7.3.1, 7.3.1.1, 7.3.1.2, 7.4.0, 7.4.0.118, 7.4.1, 7.4.1.1, 7.4.2, 7.4.2.1, 7.4.2.2, 7.4.2.3, 7.4.2.4, 7.6.0  

Defect Information


Defect IDHeadline
CSCwm33619FTD Vault process exits every 1 minute with: Process vaultApp exited normally

Problem Description


Some releases of Cisco Secure Firewall Threat Defense (FTD) Software might experience repeated exits of the VaultApp process, which can create instability on the Cisco Secure Firewall device.


Background


Some releases of Cisco Secure FTD Software might experience repeated exits of the VaultApp process, which can result in high CPU and memory consumption that causes process terminations and unplanned reboots for the Cisco Secure Firewall device and virtual instances. The device reboot results in loss of network traffic and failed policy deployments, which might affect the device security posture.


Problem Symptom


  • The VaultApp process exits every minute, resulting in the following messages in the Cisco Secure FTD vault log file, which is located in /ngfw/var/log/vault.log:
    messages:Aug 18 13:44:33 FTD SF-IMS[9236]: [9236] pm:process [INFO] Process vaultApp (23597) exited normally: 256 (0x00000100)
    messages:Aug 18 13:45:33 FTD SF-IMS[9236]: [9236] pm:process [INFO] Process vaultApp (27995) exited normally: 256 (0x00000100)
    messages:Aug 18 13:46:33 FTD SF-IMS[9236]: [9236] pm:process [INFO] Process vaultApp (32298) exited normally: 256 (0x00000100)
    messages:Aug 18 13:47:33 FTD SF-IMS[9236]: [9236] pm:process [INFO] Process vaultApp (36617) exited normally: 256 (0x00000100)
  • The output of the pmtool status command shows the VaultApp process as Down, as shown in the following example:
    root@FTD:/home/admin# pmtool statusbyid vaultApp
    Received status (0):
    vaultApp (system) - Down
    Command: /ngfw/usr/local/sf/bin/vault_app.sh
  • The VaultApp process does not show an active process ID, as shown in the following example:
    root@FTD:/home/admin# ps -aef | grep vault
    root     58155 56644  0 13:14 pts/0    00:00:00 grep vault
  • Cisco Secure Firewall Management Center (FMC) shows multiple health monitor alerts at Warning severity as a result of the VaultApp process exiting in Cisco Secure FTD and causing the device to experience high CPU usage. Devices that are configured for multi-instance mode increase the CPU usage and incident rate.

Workaround/Solution


Workaround

Reboot the Cisco Secure Firewall Security Appliance.

Solution

To fix the Cisco Secure FTD Software VaultApp issue, Cisco recommends upgrading to one of the software releases shown in the following table:

Cisco Secure FTD Software Release First Fixed Release
7.1 Migrate to a fixed release.
7.2 7.2.10
7.3 Migrate to a fixed release.
7.4 7.4.3
7.6 7.6.1

 


Additional Information


Cisco offers a guided upgrade experience through the Secure Firewall Upgrade program. This program will provide environment-specific software upgrade guidance, a customized procedure to follow, and a customized pre-upgrade checklist. For additional information and to register for the upgrade program, see Get access to Cisco Secure Firewall LevelUp.


Revision History


VersionDescriptionSectionDate
1.0Initial Release—2026-MAY-01

For More Information

For further assistance or for more information about this field notice, contact the Cisco Technical Assistance Center (TAC) using one of the following methods:

Receive Email Notification About New Field Notices

To receive email updates about Field Notices (reliability and safety issues), Security Advisories (network security issues), and end-of-life announcements for specific Cisco products, set up a profile in My Notifications.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products