EUVD-2026-81114
GHSA-vcgm-f86r-xmp4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ASA/FTD/FMC interface
-
DeliverySend crafted network input
-
ExploitTrigger incorrect-calculation (CWE-682) flaw
-
ExecutionCorrupt memory/logic state
-
ImpactCompromise device confidentiality/integrity/availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Calculation correctness
|
| Exploitation Conditions | Exploitation requires network reachability to a Cisco Secure ASA, FTD, or FMC device and no authentication (PR:N), but the CVSS vector marks AC:H - meaning success depends on specific, attacker-uncontrolled conditions inherent to the incorrect-calculation flaw (e.g. crafting inputs that produce a precise miscalculated length/offset). The advisory is a grouped internal hardening release, so no single feature, protocol, or configuration toggle is named as a prerequisite; the practical limiting factor is the high complexity of reliably triggering the calculation error, not a special product mode. Risk is concentrated on devices whose vulnerable interface is exposed to untrusted networks (e.g. internet-facing firewall data or management planes). |
| Impact | The vendor scores this 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The signal mix is genuinely notable within this hardening batch: unlike its same-advisory siblings CVE-2026-20329/20330/20331 (all PR:L, authenticated), CVE-2026-20335 is PR:N - network-reachable with NO authentication - which raises its ceiling. That elevation is tempered by AC:H (high attack complexity), consistent with a CWE-682 incorrect-calculation flaw that likely needs a specific, hard-to-arrange trigger condition (e.g. crafted values producing a boundary/overflow miscalculation) rather than a trivial request. There is NO EPSS score, NO CISA KEV listing, and NO public PoC in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The C:H/I:H/A:H impact is vendor-asserted and grouped - this is an umbrella hardening advisory covering multiple internally-discovered issues under one CWE pillar, so the exact reachable primitive is not individually specified. Net: this is a credible priority for internet-facing ASA/FTD firewalls specifically because of PR:N, but AC:H plus no evidence of exploitation, no PoC, and the vague grouped nature argue against treating it as an emergency on par with a confirmed-exploited RCE. Patch on the normal accelerated cycle for edge firewall software. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends specially crafted traffic to an exposed ASA/FTD/FMC interface, triggering an incorrect-calculation condition (CWE-682) in a parsing or length-handling routine. Because the flaw requires precise conditions (AC:H) it is not spray-and-pray, but a successful trigger is vendor-rated as leading to high confidentiality, integrity, and availability impact on the device. No public exploit code is known at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat Defense (FTD) Software, and Secure Firewall Management Center (FMC) Software can be triggered by remote, unauthenticated attackers over the network and may result in high confidentiality, integrity, and availability impact across affected firewalls and their management plane. Cisco rates the group at CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but the vector's AC:H reflects that exploitation depends on attacker-uncontrolled conditions - reliably producing the precise malformed input that causes the miscalculation is the practical barrier, and the bundled advisory names no single feature, protocol, or configuration toggle as a prerequisite. The flaws were found during Cisco's own internal hardening review, so there is no public exploit identified at time of analysis and no CISA KEV listing; remediation is delivered through Cisco's hardening release rather than awaiting out-of-band emergency fixes.
RemediationAI
Apply the software hardening release from Cisco that specifically addresses CVE-2026-20335; because Cisco shipped these fixes as a bundled internal-review hardening update, patch availability is confirmed per vendor advisory rather than by a single published fix version, and administrators should consult the Cisco advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN to identify the exact fixed build for each ASA 9.16/9.18/9.20/9.22/9.23/9.24, FTD 7.0/7.3/7.4/7.6/7.7/10.0, and FMC 7.0/7.2/7.3/7.4/7.6/7.7/10.0 branch in use, since Cisco typically publishes per-train fixed releases instead of a single global version. In the interim, treat exposure reduction as the primary compensating control: restrict inbound access to ASA/FTD data interfaces and, critically, lock down FMC and FTD/ASA management interfaces so they are reachable only from trusted administrative networks or out-of-band management segments - the trade-off is that this blocks legitimate remote administration until the patch is applied. Disable any unused inspection, remote-access, or management features on the affected device so fewer calculation code paths are reachable, accepting reduced functionality as the cost, and segment high-value firewall and management appliances from untrusted networks so a successful trigger cannot pivot into the broader estate. Monitor Cisco's advisory for revision, and enable logging/telemetry on ASA, FTD, and FMC for anomalous process behavior, given the potential availability and integrity impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-20335 is a grouping of defects under CWE-682 (Incorrect Calculation), a CWE pillar covering arithmetic, size, length, offset, and resource-computation errors rather than one specific coding mistake. In the context of Cisco Secure Firewall ASA, FTD, and FMC software, such calculation errors typically arise where packet parsing, buffer sizing, session/flow accounting, or management-plane data handling derive a value that does not match the actual quantity being processed, enabling out-of-bounds access, information disclosure, or state corruption. The CPE data confirms the affected code base spans three distinct deliverables - cpe:2.3:a:cisco:cisco_secure_firewall_adaptive_security_appliance_(asa)_software, cpe:2.3:a:cisco:cisco_secure_firewall_threat_defense_(ftd)_software, and cpe:2.3:a:cisco:cisco_secure_firewall_management_center_(fmc) - which means the same class of arithmetic defect was addressed in both the enforcement data plane (ASA/FTD) and the centralized management plane (FMC). Because the issue is a family of independent calculation bugs released as a single hardening bundle, each individual defect may have a different trigger surface, and the CVSS AC:H rating reflects that an attacker must craft input matching the specific miscalculation rather than simply sending generic malformed traffic. The advisory is published under Cisco's standard security advisory ID cisco-sa-hardening-asaftdfmc-uvpPROhN.
Know when Cisco Secure Firewall Adaptive Security Appliance Asa Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Agree with Cisco's shape: network-reachable and unauthenticated (AV:N/PR:N) but AC:H for the specific calculation trigger; C/I/A:H are vendor-asserted for this grouped hardening release.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20335 are related to incorrect calculation issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-682.
Executive ViewAI
Cisco Secure Firewall ASA, FTD, and FMC software contain multiple incorrect-calculation flaws (CVE-2026-20335) that remote, unauthenticated attackers could exploit to achieve high confidentiality, integrity, and availability impact across firewalls and their management plane. Organizations relying on these Cisco firewalls for network segmentation and perimeter defense face potential compromise of critical security controls, which could expose sensitive data and disrupt operations. With no public exploit identified at time of analysis and no vendor patch available, leadership should prioritize interim mitigations and monitoring.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting management plane access to trusted networks, enabling detailed logging and monitoring, and applying Cisco's hardening release when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to r
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be trigge
Exploit-DB