What is the CVSS score of CVE-2026-20014?

CVE-2026-20014 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-20014?

Within 24 hours: Inventory all affected Cisco ASA and FTD devices and document current VPN user access patterns. Within 7 days: Implement network segmentation to restrict IKEv2 traffic to trusted sources only and enable enhanced monitoring for anomalous VPN authentication attempts. Within 30 days: Evaluate vendor security advisories for patch availability and plan upgrade windows; consider temporary disablement of IKEv2 if IKEv1 or alternative VPN protocols are available.

Adaptive Security Appliance Software CVE-2026-20014

HIGH

Memory Leak (CWE-401)

2026-03-04 psirt@cisco.com

Information Disclosure Cisco Adaptive Security Appliance Software Firepower Threat Defense Software

7.7

CVSS 3.1 · Vendor: cisco

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate with valid VPN credentials
Delivery

Send crafted IKEv2 packets
Exploit

Trigger improper packet processing
Execution

Exhaust device memory
Impact

Force device reload

Vulnerability Assessment

Weakness	CWE CWE-401 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Resource cleanup, leak prevention
Exploitation Conditions	Valid VPN user credentials required; IKEv2 feature enabled on Cisco Secure Firewall ASA or Cisco Secure FTD; attacker must authenticate to VPN before sending crafted packets.
Impact	CVSS 7.7 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitation requires authentication. Exploitable via remote/network.
Exploit ScenarioDerived	A remote attacker (requires authentication) could exploit this vulnerability to exhaust memory, causing the device to reload.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Memory exhaustion in Cisco Secure Firewall ASA and FTD IKEv2 implementations allows authenticated remote attackers with valid VPN credentials to trigger device reloads by sending crafted packets, disrupting firewall availability and downstream network services. The vulnerability stems from improper IKEv2 packet processing that fails to constrain memory allocation. No patch is currently available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:05 CVSS 7.7

IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software is affected by memory leak (CVSS 7.7).

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability (CWE-401: Memory Leak) affects IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, remote attacker with valid VPN user credentials to cause a DoS condition on an affected device that may also impact the availability of services to devices elsewhere in the network. This vulnerability is due to the improper processing of IKEv2 packets. An attacker could exploit this vulnerability by sending crafted, authenticated IKEv2 packets to an affected device. A success

Know when Adaptive Security Appliance Software gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (cisco) PRIMARY 7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Primary rating from Vendor (cisco) · only source for this CVE.

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

DescriptionCVE.org

A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, remote attacker with valid VPN user credentials to cause a DoS condition on an affected device that may also impact the availability of services to devices elsewhere in the network. This vulnerability is due to the improper processing of IKEv2 packets. An attacker could exploit this vulnerability by sending crafted, authenticated IKEv2 packets to an affected device. A successful exploit could allow the attacker to exhaust memory, causing the device to reload.

Executive ViewAI

Why It Matters

A high-severity vulnerability in Cisco Secure Firewall and FTD devices could allow authenticated VPN users to disrupt firewall operations, potentially cascading to impact network availability and dependent services. Organizations using these platforms for remote access or site-to-site connectivity face operational risk until mitigation is implemented.

Business Impact: High

Compensating Controls

Disable IKEv2 protocol if IKEv1 or other VPN protocols meet business requirements; implement strict firewall rules limiting IKEv2 access to known, trusted remote locations only; deploy network segmentation to isolate VPN gateway infrastructure; enable detailed logging and real-time alerting on VPN authentication failures and firewall process anomalies; establish incident response procedures for rapid firewall failover if DoS occurs.

Threat Intelligence Overview

EPSS Score

0.2%

Top 62% exploitable

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.