Cisco Secure Firewall CVE-2026-20121

Exploitation requires the affected ASA/FTD device to have an access control list configured with Object Group Search (OGS) enabled and populated into group access control policies (ACPs); the logic error only manifests under that specific configuration, so devices without OGS are not affected. No authentication or user interaction is needed (PR:N/UI:N) and the attacker only needs to send traffic through the device, but the attacker must be positioned so that their traffic transits the firewall toward a protected segment. The OGS/group-ACP requirement is the primary limiting factor that narrows real-world exposure below what the unauthenticated network vector alone would suggest.

All available signals point to a genuine but moderate-severity issue rather than a critical emergency. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3, Medium) describes a remotely reachable, unauthenticated, low-complexity flaw whose only impact is a limited integrity effect (I:L) - bypassing configured ACLs - with no confidentiality (C:N) or availability (A:N) impact and no scope change (S:U). There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so this is 'no public exploit identified at time of analysis' - do not conflate the network/unauthenticated vector with active exploitation. The real limiter is configuration-dependence: the logic error only manifests on devices where ACLs use Object Group Search (OGS) together with group access control policies, so despite PR:N the flaw does not affect all default deployments. Net: prioritize for patching because it is a security-control (firewall ACL) bypass on ubiquitous perimeter devices, but the modest CVSS, single limited-integrity impact, absence of KEV/POC/EPSS, and the OGS configuration precondition place it below urgent 'exploited-in-the-wild' items. Reported by Cisco with a dedicated PSIRT advisory (cisco-sa-ftd-acl-bypass-8p6vFvw), which lends high source confidence.

An unauthenticated attacker positioned to route traffic through an affected ASA/FTD device sends traffic that the configured access control policy should block; because of the OGS logic error populating group ACPs, the firewall permits the flow, allowing the attacker to reach hosts in a protected network segment. No public exploit code is identified at time of analysis, and no special tooling is required beyond the ability to send packets through the device.