Adaptive Security Appliance Software
CVE-2026-20039
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP requests to VPN web server
-
DeliveryTrigger ineffective memory management
-
ExploitExhaust device memory
-
ExecutionForce device reload
-
ImpactAchieve denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Improper clearing of heap data
|
| Exploitation Conditions | VPN web server accessible on affected Cisco Secure Firewall ASA or FTD device. No authentication required. Exploitation works against default configurations with VPN web server enabled. |
| Impact | CVSS 8.6 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitation no authentication required. Exploitable via remote/network. |
| Exploit ScenarioDerived | A remote attacker without authentication could exploit this vulnerability to cause the device to reload, resulting in a DoS condition. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Unauthenticated remote attackers can trigger a denial of service against Cisco Secure Firewall ASA and FTD devices by sending crafted HTTP requests to the VPN web server, exploiting ineffective memory management to force device reloads. The vulnerability requires no authentication or user interaction and affects all network-exposed instances. No patch is currently available.
Earlier versions of this analysis (1)
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. [CVSS 8.6 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to ineffective memory management of the VPN web server. An attacker could exploit this vulnerability by sending a large number of crafted HTTP requests to an affected device. A successful exploit could al
Know when Adaptive Security Appliance Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to ineffective memory management of the VPN web server. An attacker could exploit this vulnerability by sending a large number of crafted HTTP requests to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
Executive ViewAI
Cisco Secure Firewall devices (ASA and FTD) are vulnerable to unauthenticated remote denial-of-service attacks that could disrupt VPN access for remote workers and branch offices. With no patch currently available, organizations must implement immediate mitigations to protect business continuity and prevent service outages.
Implement network-based rate limiting and DDoS protection on VPN portal access; restrict VPN web server access to known administrator/user IP ranges via firewall ACLs; disable VPN web portal if not actively used and rely on VPN client software instead; enable geo-blocking if applicable; deploy external WAF or DDoS mitigation service in front of VPN endpoints; monitor VPN server resource utilization and configure alerts for abnormal traffic patterns; segment VPN infrastructure from critical systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Th
A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remo
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Fir
Unauthenticated remote access to restricted VPN web server endpoints in Cisco Secure ASA and Firepower Threat Defense (F
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Th
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Th
Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0
A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Softw
Cisco ASA and FTD management and VPN web servers contain a vulnerability causing device reload through incomplete error
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secu
Denial of service via crafted HTTP requests to the Remote Access SSL VPN service affects Cisco Secure Firewall ASA and F
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower
GitHub PoC
Exploit-DB