What is the CVSS score of CVE-2026-20014?

CVE-2026-20014 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Cisco are affected by CVE-2026-20014?

A high-severity vulnerability in Cisco Secure Firewall and FTD devices could allow authenticated VPN users to disrupt firewall operations, potentially cascading to impact network availability and…

How to fix or mitigate CVE-2026-20014?

Within 24 hours: Inventory all affected Cisco ASA and FTD devices and document current VPN user access patterns. Within 7 days: Implement network segmentation to restrict IKEv2 traffic to trusted sources only and enable enhanced monitoring for anomalous VPN authentication attempts. Within 30 days: Evaluate vendor security advisories for patch availability and plan upgrade windows; consider temporary disablement of IKEv2 if IKEv1 or alternative VPN protocols are available.

Cisco CVE-2026-20014

HIGH

Memory Leak (CWE-401)

2026-03-04 psirt@cisco.com

Cisco Information Disclosure

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 20:22 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

CVE Published

Mar 04, 2026 - 18:16 nvd

HIGH 7.7

DescriptionCVE.org

A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, remote attacker with valid VPN user credentials to cause a DoS condition on an affected device that may also impact the availability of services to devices elsewhere in the network. This vulnerability is due to the improper processing of IKEv2 packets. An attacker could exploit this vulnerability by sending crafted, authenticated IKEv2 packets to an affected device. A successful exploit could allow the attacker to exhaust memory, causing the device to reload.

AnalysisAI

Memory exhaustion in Cisco Secure Firewall ASA and FTD IKEv2 implementations allows authenticated remote attackers with valid VPN credentials to trigger device reloads by sending crafted packets, disrupting firewall availability and downstream network services. The vulnerability stems from improper IKEv2 packet processing that fails to constrain memory allocation. No patch is currently available.

Technical ContextAI

This vulnerability (CWE-401: Memory Leak) affects IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, remote attacker with valid VPN user credentials to cause a DoS condition on an affected device that may also impact the availability of services to devices elsewhere in the network. This vulnerability is due to the improper processing of IKEv2 packets. An attacker could exploit this vulnerability by sending crafted, authenticated IKEv2 packets to an affected device. A success