What is the CVSS score of CVE-2026-20082?

CVE-2026-20082 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Cisco are affected by CVE-2026-20082?

Cisco Secure Firewall ASA devices are vulnerable to a denial-of-service attack where unauthenticated remote attackers can cause legitimate TCP connections to be dropped, potentially disrupting…

How to fix or mitigate CVE-2026-20082?

Within 24 hours: Identify all Cisco ASA devices in your environment and document current firmware versions; assess which systems are internet-facing or receive untrusted traffic. Within 7 days: Implement network-based rate limiting on embryonic connection thresholds where possible; coordinate with Cisco support for interim guidance and patch timelines. Within 30 days: Develop and test a firmware upgrade plan; monitor Cisco advisories for patch release; consider temporary traffic filtering rules to reduce SYN flood exposure while awaiting patches.

Cisco CVE-2026-20082

HIGH

Missing Release of Resource after Effective Lifetime (CWE-772)

2026-03-04 psirt@cisco.com

Cisco Denial Of Service

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

CVE Published

Mar 04, 2026 - 18:16 nvd

HIGH 8.6

DescriptionCVE.org

A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause incoming TCP SYN packets to be dropped incorrectly. This vulnerability is due to improper handling of new, incoming TCP connections that are destined to management or data interfaces when the device is under a TCP SYN flood attack. An attacker could exploit this vulnerability by sending a crafted stream of traffic to an affected device. A successful exploit could allow the attacker to prevent all incoming TCP connections to the device from being established, including remote management access, Remote Access VPN (RAVPN) connections, and all network protocols that are TCP-based. This results in a denial of service (DoS) condition for affected features.

AnalysisAI

Cisco Secure Firewall ASA devices fail to properly manage embryonic connection limits during TCP SYN flood attacks, allowing unauthenticated remote attackers to block all incoming TCP connections including management access and VPN services. An attacker can exploit this denial-of-service vulnerability by sending crafted traffic streams to management or data interfaces, effectively isolating the device from legitimate network access. No patch is currently available for this HIGH severity vulnerability.

Technical ContextAI

This vulnerability (CWE-772: Missing Release of Resource after Effective Lifetime) exists in the a denial of component. in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause incoming TCP SYN packets to be dropped incorrectly. This vulnerability is due to improper handling of new, incoming TCP connections that are destined to management or data interfaces when the device is under a TCP SYN flood attack. An attacker could exploit this vulnerability by sending a crafted stream of traffic to an