What is the CVSS score of CVE-2026-20103?

CVE-2026-20103 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Adaptive Security Appliance Software are affected by CVE-2026-20103?

An unauthenticated attacker can remotely crash Cisco Secure Firewall devices by exploiting the SSL VPN feature, causing denial of service to legitimate remote workers.

How to fix or mitigate CVE-2026-20103?

Within 24 hours: Inventory all Cisco ASA and FTD devices running SSL VPN and assess business criticality of each. Within 7 days: Implement network segmentation to restrict SSL VPN access to known IP ranges and enable connection rate limiting on VPN gateways. Within 30 days: Monitor Cisco security advisories for patch release and develop a maintenance window plan for rapid deployment; consider temporary disabling of SSL VPN on non-critical assets if business continuity allows.

Adaptive Security Appliance Software CVE-2026-20103

HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-03-04 psirt@cisco.com

Denial Of Service Cisco Adaptive Security Appliance Software Firepower Threat Defense Software

8.6

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Primary rating from Vendor (cisco) · only source for this CVE.

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 20:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

CVE Published

Mar 04, 2026 - 18:16 nvd

HIGH 8.6

DescriptionCVE.org

A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust device memory resulting in a denial of service (DoS) condition to new Remote Access SSL VPN connections. This does not affect the management interface, though it may become temporarily unresponsive. This vulnerability is due to trusting user input without validation. An attacker could exploit this vulnerability by sending crafted packets to the Remote Access SSL VPN server. A successful exploit could allow the attacker to cause the device web interface to stop responding, resulting in a DoS condition.

AnalysisAI

Denial of service in Cisco Secure Firewall ASA and FTD Remote Access SSL VPN allows unauthenticated remote attackers to exhaust device memory through malformed packets, causing the VPN service to become unresponsive. The vulnerability stems from insufficient input validation on the SSL VPN server and currently has no available patch. While the management interface remains accessible, new VPN connections cannot be established during an attack.

Technical ContextAI

This vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) exists in the Remote Access SSL VPN component. in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust device memory resulting in a denial of service (DoS) condition to new Remote Access SSL VPN connections. This does not affect the management interface, though it may become temporarily unresponsive. This vulnerability is due to trusting user input without validation. An attac