EUVD-2026-81133
GHSA-2vf5-qc6p-8g6v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privilege admin access
-
DeliverySubmit crafted input to vulnerable component
-
ExploitInduce required user interaction
-
ExecutionBreach component/scope boundary (S:C)
-
ImpactCompromise confidentiality, integrity and availability
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires PR:H - valid high-privilege administrative credentials on the Cisco Secure ASA, FTD, or FMC software - AND UI:R, a separate user interaction to trigger the defect, per the CVSS vector. These two preconditions are the primary limiting factors and make untrusted or unauthenticated exploitation infeasible. The advisory does not name a specific feature, protocol, or non-default setting; it describes a hardening release addressing multiple internally-discovered CWE-710 coding-standard issues, so the concrete triggering surface is not disclosed. Affected trains are ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1; upgrading to the fixed hardening builds is the mitigation. |
| Impact | This is a vendor-asserted, grouped hardening-release entry (Cisco advisory cisco-sa-hardening-asaftdfmc-uvpPROhN) covering multiple internally-discovered issues bundled under CWE-710 (Improper Adherence to Coding Standards, a Pillar-level category), not a single discrete flaw with public root-cause detail. The CVSS 8.4 (High) vector AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H reads as serious impact (full C/I/A, scope change) but is heavily gated on the exploitation side: PR:H requires the attacker to already hold high-privilege administrative access, and UI:R requires a separate user/admin to take an action. That PR:H + UI:R combination makes this the MOST access-limited variant in the ASA/FTD/FMC hardening family (contrast unauthenticated adjacent CVE-2026-20336 at PR:N and the PR:L no-interaction siblings CVE-2026-20329/CVE-2026-20330). There is no EPSS score, no CISA KEV listing, and no public POC, which is consistent with an internally-found, proactively-patched cluster rather than an actively-exploited bug. Net: despite the High CVSS, real-world urgency is moderate - the PR:H precondition means an attacker must effectively already be a trusted high-privilege operator, so this is primarily a defense-in-depth / privilege-boundary hardening fix rather than an externally-facing emergency. Caveat: because the advisory is a grouped hardening bundle, the CVSS metrics are Cisco-asserted composites and cannot be independently verified against a specific code path. |
| Exploit ScenarioDerived | A high-privilege authenticated administrator (or an attacker who has compromised such an account) on a Cisco Secure ASA/FTD/FMC device crafts input that abuses one of the bundled coding-standard defects, then induces another user to perform a triggering action (UI:R) to breach the component boundary. Successful exploitation crosses a security scope (S:C) to affect resources beyond the vulnerable component with full confidentiality, integrity, and availability impact. No public exploit code exists and the issue is not in CISA KEV, so this remains theoretical against patched or well-segmented deployments. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software can be triggered by an attacker who already holds high-privilege administrative credentials and who can also induce a separate user interaction, potentially yielding high confidentiality, integrity, and availability impact that crosses a security scope boundary (CVSS 8.4, CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H). The affected trains span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1. Cisco addressed these issues as a grouped hardening release (CWE-710, Improper Adherence to Coding Standards) rather than a single disclosed flaw; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
RemediationAI
Patch status: patch available per vendor advisory - Cisco published a software hardening release that addresses these internally discovered issues under advisory cisco-sa-hardening-asaftdfmc-uvpPROhN (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN); the specific fixed build numbers for each ASA 9.16-9.24, FTD 7.0-10.0, and FMC 7.0-10.0.1 train are enumerated in that advisory and are not restated in the provided data, so verify the exact fixed image against the advisory before upgrading. Because the CVSS vector requires PR:H (valid high-privilege administrative credentials) and UI:R (a separate user interaction), the practical risk is concentrated in compromised, over-privileged, or shared administrator accounts rather than unauthenticated remote actors; compensating controls should therefore target administrative access and monitoring while upgrades are staged. Restrict administrative access to ASA, FTD, and FMC management interfaces to dedicated out-of-band management networks and jump hosts, and remove any management-plane exposure to untrusted networks - the trade-off is reduced operational flexibility for remote admins and a need for bastion capacity. Enforce least privilege and unique named administrator accounts, eliminate shared local admin credentials, and integrate AAA (TACACS+/RADIUS) with per-command authorization - this does not remediate the coding defects but meaningfully reduces the ability to satisfy PR:H, at the cost of additional identity infrastructure and possible workflow disruption. Require MFA on FMC and device management logins and be aware that UI:R implies a social-engineering or click-driven trigger, so user-interaction prompts from unsolicited sessions should be treated as hostile. Note that no public exploit code was identified at time of analysis, so there is no urgent need for emergency break-fix beyond normal change windows, but apply the hardening builds promptly given the breadth of affected releases. Continue monitoring the Cisco advisory for any revision that names specific features or non-default settings to disable; until then, generic feature-disabling guidance would be speculative and is not recommended without vendor confirmation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This entry is unusual in that it aggregates several internally discovered weaknesses under CWE-710, a Pillar-level category for 'Improper Adherence to Coding Standards' rather than a specific implementation defect class such as CWE-787 (out-of-bounds write) or CWE-416 (use-after-free). Because the taxonomy node is a pillar, the advisory does not pin down a single root cause, feature, protocol, or non-default configuration; the underlying issues are described only as coding-standard deviations found during Cisco's comprehensive internal security review of Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software, and Cisco Secure Firewall Management Center Software. The CPE entries confirm three distinct but tightly coupled code bases are in scope: cpe:2.3:a:cisco:cisco_secure_firewall_adaptive_security_appliance_(asa)_software, cpe:2.3:a:cisco:cisco_secure_firewall_threat_defense_(ftd)_software, and cpe:2.3:a:cisco:cisco_secure_firewall_management_center_(fmc). These components interoperate in a typical deployment - FMC centrally manages FTD and ASA devices, and FTD runs on the same underlying hardware/software lineage as ASA - so a coding-standard weakness in a shared management or platform layer can propagate across the management plane and the enforcement plane. The S:C scope-change component of the vector indicates that successful exploitation affects resources beyond the vulnerable component's own security authority, consistent with a defect reachable from a managed device or management session that then impacts the broader firewall estate. The tags associated with this record emphasize Information Disclosure as the observed consequence category, and the affected-version list from ENISA EUVD shows the breadth of exposure: hundreds of point releases across ASA 9.16.x, 9.18.x, 9.20.x, 9.22.x, 9.23.x and 9.24.x, FTD 7.0.x through 7.7.x plus 10.0.0, and FMC 7.0.x through 7.7.x plus 10.0.0 and 10.0.1.
Know when Cisco Secure Firewall Adaptive Security Appliance Asa Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Accepting Cisco's vendor-asserted metrics: network-reachable but gated by high-privilege auth (PR:H) plus required user interaction (UI:R), with a scope-crossing full-impact outcome (S:C, C/I/A:H).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20334 are related to issues concerning improper adherence to coding standards that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-710.
Executive ViewAI
Cisco Secure Firewall ASA, Threat Defense, and Firewall Management Center software contain multiple coding-standard defects that could allow an attacker with high-privilege administrative credentials and the ability to induce user interaction to compromise confidentiality, integrity, and availability across security boundaries. These products form critical network perimeter defenses, so exploitation could undermine an organization's entire security posture, yet the prerequisites of administrative access and user interaction limit the attack surface to insider threats or compromised administrative accounts. Leadership should prioritize mitigating this risk while awaiting a vendor patch, as these systems are high-value targets.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict administrative access to trusted networks and users, enforce multi-factor authentication for high-privilege accounts, monitor for unauthorized configuration changes or anomalous user interactions, and apply Cisco's grouped hardening release when it becomes available or follow any specific workarounds provided in Cisco's advisory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to r
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be trigge
Exploit-DB