EUVD-2026-81119
GHSA-w3f5-j392-38wg
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent unauthenticated vector per vendor (AV:A/PR:N); accepting vendor-asserted C:H/I:H/A:H and S:U for a resource-lifetime flaw on the device itself, though the grouped advisory prevents independent metric verification.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20336 are related to issues concerning improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.
AnalysisAI
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco Secure Firewall ASA, FTD, and FMC software to potentially achieve full confidentiality, integrity, and availability impact (CVSS 8.8). The vulnerabilities were internally discovered and addressed in a Cisco hardening release; the exact affected feature is not publicly detailed, and no public exploit code has been identified at time of analysis.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to be on an adjacent network (AV:A) - the same L2 broadcast domain or a logically adjacent segment such as the appliance's management network - reachable to the ASA/FTD/FMC software; it does NOT require authentication (PR:N) or user interaction (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a member of Cisco's bundled hardening release for ASA/FTD/FMC (advisory cisco-sa-hardening-asaftdfmc-uvpPROhN), grouped under the abstract Pillar weakness CWE-664 (improper control of a resource through its lifetime), so the underlying flaw is described only at a high level and not attributable to a single concrete bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the hardening update described in Cisco advisory cisco-sa-hardening-asaftdfmc-uvpPROhN (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Cisco Secure Firewall ASA, FTD, and FMC deployments and restrict adjacent-network access to management and data interfaces through segmentation, ACLs, and enhanced logging; contact Cisco TAC to confirm whether the reported hardening release applies to your exact ASA, FTD, and FMC versions, noting that no vendor-released patch identified at time of analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to r
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be trigge
Access-control bypass in Cisco Secure Firewall ASA and Threat Defense (FTD) software allows an unauthenticated, remote a
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today