EUVD-2026-81118
GHSA-q3fg-q5c4-7677
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach IKEv2 VPN listener on ASA/FTD
-
DeliveryInitiate IKEv2 connection with crafted certificate
-
ExploitTrigger logic error in cert-auth phase
-
ExecutionCrash IKEv2 process
-
ImpactDevice reloads, denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Correct type conversion
|
| Exploitation Conditions | Exploitable only when the affected ASA/FTD device is configured for IKEv2 VPN with certificate-based authentication (the certification authentication feature of IKEv2); the attacker sends a crafted certificate during connection setup. Devices without IKEv2 configured, or using non-certificate (e.g., pre-shared-key) IKEv2 authentication, are not affected. The limiting factor is this specific VPN feature configuration - but where present, exploitation requires no authentication, no user interaction, and only network reachability to the IKEv2 listener (typically UDP/500 and UDP/4500), which is commonly internet-facing on VPN concentrators. Impact is limited to denial of service via process crash and device reload. |
| Impact | This is a genuine and serious availability risk despite being confidentiality/integrity-neutral. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 8.6) is internally consistent with the description: an unauthenticated, remote attacker on the network triggers a logic error (CWE-704, improper type conversion) during IKEv2 certificate authentication using only a crafted certificate - no prior credentials, no user interaction, low complexity. S:C is justified because the crash of the IKEv2 process/device reload impacts the security boundary the firewall provides for all traffic behind it, not just the attacker's session. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so this is 'no public exploit identified at time of analysis' - a real priority to patch given the low exploitation bar and internet-facing nature of VPN endpoints, but not confirmed to be under active exploitation. The main mitigating factor not reflected in the raw score is that the device must have IKEv2 with certificate-based authentication actually configured; appliances using pre-shared-key IKEv2 or without IKEv2 VPN are not exposed. Impact ceiling is DoS only (crash/reload), not code execution or data disclosure. |
| Exploit ScenarioDerived | An attacker with network reachability to the firewall's IKEv2 VPN listener initiates a VPN connection setup and presents a crafted certificate during the certificate-authentication phase. The malformed certificate triggers a logic error that crashes the IKEv2 process, forcing the ASA/FTD device to reload and dropping all VPN and transiting traffic. No authentication, credentials, or user interaction are required, and no public exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured for certificate-based IKEv2 authentication, causing an unexpected device reload and a denial-of-service condition. Exploitation requires no credentials and no user interaction; the only prerequisite is a specific configuration - IKEv2 VPN with certificate authentication enabled and the IKEv2 listener (typically UDP/500 and UDP/4500) reachable from the attacker's network, which is common on internet-facing VPN concentrators. At time of analysis there is no public exploit identified, no CISA KEV listing, and the issue is availability-only (CVSS 8.6, C:N/I:N/A:H with scope change because the process crash escalates to a full device reload); devices without IKEv2 certificate authentication are not affected.
RemediationAI
No vendor-released fixed version is specified in the provided data, so treat the Cisco advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ikev2cert-dos-uWyc2xtv) as the authoritative source for fixed ASA and FTD releases and upgrade each affected device to the recommended build for its train. Until a device can be upgraded, apply configuration-level compensation, since the flaw is only reachable when IKEv2 certificate authentication is enabled: if certificate-based IKEv2 is not required in your environment, switch the affected IKEv2 profile to pre-shared-key authentication or disable the IKEv2 listener entirely (trade-off: certificate-based remote-access and site-to-site VPN clients lose connectivity), and if certificate authentication must stay enabled, restrict reachability to the IKEv2 service by ACL so that only known peer IP addresses can hit UDP/500 and UDP/4500 (trade-off: breaks roaming or dynamic-IP VPN clients and requires ongoing peer-IP maintenance). Also monitor ASA/FTD logs and syslog for repeated IKEv2 SA negotiation failures followed by unexpected reloads, which is the observable signature of exploitation, and consider redundant/HA VPN termination so a single device reload does not sever connectivity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Internet Key Exchange version 2 (IKEv2) is the protocol used by Cisco ASA and FTD to negotiate IPsec VPN tunnels, including the IKE_AUTH exchange in which peers prove their identity using certificates. The vulnerability is classified as CWE-704 (Incorrect Type Conversion or Cast) and resides in the certificate authentication logic of that phase: a crafted certificate supplied during connection setup triggers a logic error that the IKEv2 process cannot handle, terminating the process and forcing the appliance to reload. The CVSS scope change (S:C) reflects that the fault escapes the vulnerable component - a single malformed certificate kills a system process and takes the whole firewall/VPN endpoint down, which also disrupts any other traffic traversing the device. The affected code is shared across two product lines, identified by CPE as cisco:cisco_secure_firewall_adaptive_security_appliance_(asa)_software and cisco:cisco_secure_firewall_threat_defense_(ftd)_software, spanning the ASA 9.16.x through 9.24.x trains and FTD 7.0.x through 7.7.x plus 10.0.0.
Know when Cisco Secure Firewall Adaptive Security Appliance Asa Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Unauthenticated remote crafted certificate over the network with low complexity; only availability affected via device reload, and the firewall crash changes the protection scope for downstream systems (S:C).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the certification authentication feature of Internet Key Exchange version 2 (IKEv2) for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly.
This vulnerability is due to a logic error during the certificate authentication phase of the IKEv2 connection setup. An attacker could exploit this vulnerability by attempting to establish an IKEv2 VPN connection with a crafted certificate. A successful exploit could allow the attacker to cause the IKEv2 process to crash, causing a denial of service (DoS) condition.
Executive ViewAI
Cisco Secure Firewall ASA and FTD devices configured for certificate-based IKEv2 VPN authentication are vulnerable to a remote denial-of-service attack that can cause an unexpected device reload, disrupting VPN connectivity for remote users and branch offices. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis, so affected organizations must rely on interim mitigations to maintain availability. Leadership should prioritize identifying and protecting these critical network security devices to avoid operational downtime.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling IKEv2 certificate authentication if not required, restricting access to IKEv2 listener ports (UDP/500 and UDP/4500) to trusted networks, and monitoring device logs for unexpected reloads. Organizations should also consider implementing redundancy for critical VPN concentrators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to r
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be trigge
Exploit-DB