EUVD-2026-81114
GHSA-vcgm-f86r-xmp4
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Agree with Cisco's shape: network-reachable and unauthenticated (AV:N/PR:N) but AC:H for the specific calculation trigger; C/I/A:H are vendor-asserted for this grouped hardening release.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20335 are related to incorrect calculation issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-682.
AnalysisAI
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat Defense (FTD) Software, and Secure Firewall Management Center (FMC) Software can be triggered by remote, unauthenticated attackers over the network and may result in high confidentiality, integrity, and availability impact across affected firewalls and their management plane. Cisco rates the group at CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but the vector's AC:H reflects that exploitation depends on attacker-uncontrolled conditions - reliably producing the precise malformed input that causes the miscalculation is the practical barrier, and the bundled advisory names no single feature, protocol, or configuration toggle as a prerequisite. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to a Cisco Secure ASA, FTD, or FMC device and no authentication (PR:N), but the CVSS vector marks AC:H - meaning success depends on specific, attacker-uncontrolled conditions inherent to the incorrect-calculation flaw (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor scores this 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the software hardening release from Cisco that specifically addresses CVE-2026-20335; because Cisco shipped these fixes as a bundled internal-review hardening update, patch availability is confirmed per vendor advisory rather than by a single published fix version, and administrators should consult the Cisco advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN to identify the exact fixed build for each ASA 9.16/9.18/9.20/9.22/9.23/9.24, FTD 7.0/7.3/7.4/7.6/7.7/10.0, and FMC 7.0/7.2/7.3/7.4/7.6/7.7/10.0 branch in use, since Cisco typically publishes per-train fixed releases instead of a single global version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all instances of Cisco Secure Firewall ASA, FTD, and FMC software and restrict management plane access to trusted internal networks only, ensuring that remote management is disabled or tightly controlled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to r
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be trigge
Access-control bypass in Cisco Secure Firewall ASA and Threat Defense (FTD) software allows an unauthenticated, remote a
Same weakness CWE-682 – Incorrect Calculation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today