Cisco
CVE-2026-20062
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to non-admin context
-
ExploitIssue crafted SCP copy commands
-
ExecutionBypass access controls
-
ImpactCopy sensitive config files between contexts
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V8 - Authorization Incorrect execution permissions
|
| Exploitation Conditions | Cisco Secure Firewall ASA in multiple context mode with CiscoSSH stack enabled, authenticated local access to non-admin context, and administrative privileges in source context required. |
| Impact | CVSS 7.2 (HIGH). Attack vector: Local. Complexity: High. Privileges required: High. User interaction: None. Exploitation requires authentication. Exploitable via local access. |
| Exploit ScenarioDerived | An attacker (requires authentication) could exploit this vulnerability to read, create, or overwrite sensitive files that belong to another context, inclu. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Cisco Secure Firewall ASA in multi-context mode contains an access control bypass in SCP operations that allows authenticated local administrators of one context to read, modify, or create files in other contexts, including sensitive admin and system configuration files. The vulnerability stems from improper validation of cross-context file access when the CiscoSSH stack is enabled. No patch is currently available for this high-severity flaw.
Earlier versions of this analysis (1)
A vulnerability in the CLI of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software in multiple context mode could allow an authenticated, local attacker with administrative privileges in one context to copy files to or from another context, including configuration files. [CVSS 7.2 HIGH]
RemediationAI
Monitor vendor advisories for a patch.
Affected ProductsAI
A vulnerability in the CLI of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software in multiple context mode could
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
in the CLI of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software in multiple context mode could allow an authenticated, local attacker with administrative privileges in one context to copy files to or from another context, including configuration files. This vulnerability is due to improper access controls for Secure Copy Protocol (SCP) operations when the CiscoSSH stack is enabled. An attacker could exploit this vulnerability by authenticating to a non-admin context of the dev
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A vulnerability in the CLI of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software in multiple context mode could allow an authenticated, local attacker with administrative privileges in one context to copy files to or from another context, including configuration files. This vulnerability is due to improper access controls for Secure Copy Protocol (SCP) operations when the CiscoSSH stack is enabled. An attacker could exploit this vulnerability by authenticating to a non-admin context of the device and issuing crafted SCP copy commands in that non-admin context. A successful exploit could allow the attacker to read, create, or overwrite sensitive files that belong to another context, including the admin and system contexts. The attacker cannot directly impact the availability of services pertaining to other contexts. To exploit this vulnerability, the attacker must have valid administrative credentials for a non-admin context. Note: An attacker cannot list or enumerate files from another context and would need to know the exact file path, which increases the complexity of a successful attack.
Executive ViewAI
A high-severity vulnerability in Cisco Secure Firewall ASA software allows authenticated administrators with access to one security context to illegally access and exfiltrate configuration files from other isolated contexts. This breaks the multi-tenancy isolation model and could expose sensitive network configurations, credentials, and security policies across administratively segregated environments.
Restrict administrative CLI access to trusted networks only via firewall rules; disable multi-context mode if operationally feasible; implement strict role-based access controls limiting administrative privileges to only necessary contexts; enable enhanced CLI command logging and monitoring for file copy operations (copy, xcopy commands); implement network segmentation to prevent lateral movement between contexts; conduct forensic audit of administrative activity logs for unauthorized context-to-context file access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
GitHub PoC
Exploit-DB