Cisco Secure Firewall CVE-2026-20120

Exploitation requires that the affected ASA/FTD device have the Access Control List Object Group Search (OGS) feature enabled AND use group access control policies (ACPs) - the logic error only manifests in that specific configuration, so devices without OGS are not affected. The attacker must also be able to send traffic through the device (i.e., be on a network path that the firewall inspects) and target a network segment the firewall is supposed to protect. No authentication and no user interaction are needed (PR:N/UI:N), but the OGS configuration dependency is the primary limiting factor that keeps this below its raw CVSS score for most deployments.

This is a genuine but moderate-severity access-control bypass, not a critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N = 5.8 Medium) is internally consistent with the description: an unauthenticated, remote attacker sends traffic through the device, requiring no privileges, no user interaction, and low complexity, with a scope change (S:C) reflecting that the firewall's failure lets traffic reach protected systems it does not itself own. Impact is deliberately narrow - integrity-only (I:L) with no confidentiality or availability effect - because the flaw only permits traffic that should have been dropped to pass; it does not compromise the ASA/FTD device itself, disclose data, or crash it. Critically, all exploitation signals point AWAY from urgency: no CISA KEV listing, no public POC identified, and no EPSS score was provided in the input, so exploitation probability cannot be quantified. The real limiter is configuration dependence - the ACL Object Group Search (OGS) feature must be enabled and group access control policies in use - which sharply narrows the exploitable population below the raw ASA/FTD install base. Treat this as a routine patch-cycle item for environments confirmed to run OGS, rather than an emergency.

An attacker positioned to route packets through an affected ASA/FTD firewall crafts and sends traffic that the configured access control policy should block, exploiting a logic error in how group ACPs are populated when OGS is enabled. The traffic is incorrectly permitted, letting the attacker reach hosts in a protected network segment behind the firewall. No public exploit code has been identified at time of analysis, and success depends on the specific OGS/group-ACP configuration being present.