Skip to content
Patcharo

Guides

Cisco Secure Firewall release trains: Threat Defense, Management Center and ASA versions explained

How Cisco numbers the releases of Secure Firewall Threat Defense, Management Center and ASA, what a train and a patch are, how the Management Center constrains the Threat Defense version, where the vendor states its suggested release, and what Patcharo reads.

Who it is for
Engineers who run Cisco Secure Firewall Threat Defense, Management Center or ASA and read Cisco release numbers in advisories and inventories.
Scope
Secure Firewall Threat Defense (FTD), Secure Firewall Management Center (FMC) and the ASA software. Not IOS XE, ISE or the other Cisco families, which have their own numbering and are outside Patcharo's catalog.

Published 19 Oct 2026 · Updated 19 Oct 2026 · Sources checked 19 Oct 2026

Trains, releases and patches

Cisco publishes Threat Defense and Management Center software in release trains named by their first two numbers, with one release notes document per train. Within a train, the third number counts the releases; a fourth number, when present, names a patch of that release, published to fix issues without changing the release's features. The release notes of a train carry a Release Dates table with every release and patch of the train, its build number, its date and the platforms it applies to; some entries apply to the Management Center alone.

ASA software is numbered with parentheses: a train, then the release in parentheses, with an optional interim number after a dot inside them. The ASA release notes of a train announce each release under a New Features heading with its release date and list the resolved bugs of interim releases. Cisco's advisories and Patcharo write ASA versions in the dotted form, which is how the vendor's comparison tools order them.

WrittenWhat it isWhere Cisco documents it
7.6A Threat Defense and Management Center trainThe train's release notes document
7.6.2The second release of the 7.6 trainThe Release Dates table and the release's own sections
7.6.2.1A patch of release 7.6.2The Release Dates table
9.19(1), written 9.19.1The first release of the ASA 9.19 trainThe ASA 9.19(x) release notes, New Features section
9.19(1.12), written 9.19.1.12An interim release of ASA 9.19(1)The same document, Resolved Bugs sections
The forms of the identifiers; the numbers illustrate the forms, not the current releases. A dated example written for this guide; the current releases are in the live block and on the product pages.

The Management Center sets the ceiling

A Secure Firewall Management Center manages Threat Defense devices whose version is the same as or older than its own, within the compatibility the Compatibility Guide states. Upgrading a Threat Defense device to a release newer than its Management Center is not supported: the Management Center is upgraded first. The same guide lists the hardware and virtual platforms each release supports; a release absent from your platform's row is not a candidate.

Threat Defense and Management Center share one release notes document per train, and a release may exist for one and not the other: the Release Dates table says which platforms a release applies to. Patcharo lists the Management Center releases and the Threat Defense releases apart for that reason.

Suggested releases and long-term trains

Cisco marks a suggested release per train in its Software Download portal, behind a sign-in, and describes in its release notes which trains are long-term and which are short-term. Patcharo does not read the download portal and therefore shows no Cisco recommendation: the catalog says which releases exist and when they were published, the advisories say which release fixes what, and the vendor's suggestion is read by you in the portal.

The newest release of a train is not Cisco's suggested release, and a suggested release is not the first fixed release of your advisories. Read the three apart, as for every vendor.

Fixed releases per train and end of life

A Cisco security advisory states, for each affected train, the first release that fixes the vulnerability, or that the train is not fixed and must be migrated. The release stated for one train says nothing about another train. Cisco also publishes end-of-sale and end-of-life bulletins for its hardware and software: a train past its end of software maintenance receives no new fixes, and the advisory then names a migration.

  • To know which release fixes a vulnerability, read the advisory's fixed releases for your train, or use the vendor's Software Checker with your exact version.
  • To know what a release contains and what it still has, read its sections in the train's release notes.
  • To know whether a release runs on your platform and with your Management Center, read the Compatibility Guide.
  • To know how long a train and a platform are maintained, read the end-of-sale and end-of-life bulletins.

The current Cisco releases, as the catalog reads them

Patcharo reads the release notes of each train listed on Cisco's release notes pages about every six hours: the Release Dates table for Threat Defense and Management Center, the release announcements for ASA. The block below is that reading, with the day it was last verified; no recommendation is shown for Cisco.

Current versions, from the catalog

Read from the vendor's own documents by the collection described in this guide; the examples in the text are illustrative and dated, these facts are live.

Secure Firewall Threat Defense (FTD)

Product page
  • 7.7Latest public release —Vendor recommendation —Not collected
  • 7.3Latest public release —Vendor recommendation —Not collected
  • 7.2Latest public release —Vendor recommendation —Not collected
  • 7.0Latest public release —Vendor recommendation —Not collected

Secure Firewall Management Center (FMC)

Product page
  • 7.7Latest public release —Vendor recommendation —Not collected
  • 7.3Latest public release —Vendor recommendation —Not collected
  • 7.2Latest public release —Vendor recommendation —Not collected
  • 7.0Latest public release —Vendor recommendation —Not collected

Secure Firewall ASA

Product page
  • 9.23Latest public release —Vendor recommendation —Not collected
  • 9.19Latest public release —Vendor recommendation —Not collected
  • 9.18Latest public release —Vendor recommendation —Not collected
  • 9.16Latest public release —Vendor recommendation —Not collected

Availability, recommendation and support are read from the vendor's documents and shown apart; a release Patcharo lists is not advice to install it.

Frequent mistakes

  • Upgrading a Threat Defense device to a release newer than its Management Center.
  • Reading a fixed release stated for one train as valid for another train.
  • Taking the newest release of a train for Cisco's suggested release.
  • Comparing ASA versions in their parenthesised form by eye instead of their dotted order.

What to verify before acting

  • The exact version each device reports, in dotted form, and the Management Center's version.
  • The first fixed release the advisory states for your train.
  • The Compatibility Guide rows of your platform and of the Management Center and Threat Defense pair.
  • The end-of-sale and end-of-life bulletins of your platform and train.

Sources

The official documents this guide rests on, read against the text on 19 Oct 2026. Nothing here is copied from them: read them for the authoritative wording.