What is the CVSS score of CVE-2026-20101?

CVE-2026-20101 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Cisco are affected by CVE-2026-20101?

A critical vulnerability in Cisco Secure Firewall ASA and FTD SAML SSO functionality allows remote attackers to crash affected devices without authentication, disrupting network access and security…

How to fix or mitigate CVE-2026-20101?

Within 24 hours: Inventory all Cisco ASA and FTD deployments; identify which are exposed to untrusted networks; assess business criticality of each. Within 7 days: Implement network segmentation to restrict SAML SSO endpoints to trusted IP ranges only; disable SAML SSO feature if not actively used; establish continuous monitoring for reload events. Within 30 days: Monitor Cisco security bulletins for patch availability; plan and execute patching in maintenance windows; validate functionality post-patch.

Cisco CVE-2026-20101

HIGH

Use of Insufficiently Random Values (CWE-330)

2026-03-04 psirt@cisco.com

Cisco Information Disclosure

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 20:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

CVE Published

Mar 04, 2026 - 18:16 nvd

HIGH 8.6

DescriptionCVE.org

A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition. This vulnerability is due to insufficient error checking when processing SAML messages. An attacker could exploit this vulnerability by sending crafted SAML messages to the SAML service. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

AnalysisAI

Cisco Secure Firewall ASA and Secure FTD devices can be remotely rebooted by unauthenticated attackers through malformed SAML 2.0 authentication messages, causing service unavailability due to insufficient input validation. The vulnerability has a high attack surface as it requires no authentication or user interaction and affects the device's core authentication mechanism. No patch is currently available.

Technical ContextAI

Classified as CWE-330 (Use of Insufficiently Random Values). A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition. This vulnerability is due to insufficient error checking when processing SAML messages. An attacker could exploit this vulnerability by sending crafted SAML messages to the SAML service. A successful exploit could allow the attacker to cause the device