EUVD-2026-80889
GHSA-rxhv-qf6p-6qjj
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Deferring to Cisco PSIRT's adjacent, unauthenticated, scope-changing profile as the only technical signal available; impacts accepted as vendor-asserted since the grouped advisory gives no basis to lower them.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20331 are related to the failure of protection mechanisms issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-693.
AnalysisAI
Protection-mechanism failures in Cisco Secure ASA, Cisco Secure Firewall Threat Defense, and Cisco Secure Firewall Management Center software allow an unauthenticated attacker on an adjacent network to achieve high confidentiality and integrity impact, with low availability impact, under a CVSS 9.6 vector. Cisco issued this grouped hardening CVE for multiple internally discovered CWE-693 issues; no public exploit has been identified at time of analysis and active exploitation is not confirmed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to be on a logically or physically adjacent network to the affected Cisco Secure ASA, FTD, or FMC device (AV:A) - not routable from the arbitrary internet - but needs no credentials (PR:N) and no user interaction (UI:N), and works at low complexity (AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and lean toward 'high-CVSS but unverifiable-detail' rather than confirmed imminent threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: Cisco has released a software hardening update addressing these internally discovered issues, but exact fixed version numbers were not provided in the supplied data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all instances of Cisco Secure ASA, Cisco Secure Firewall Threat Defense, and Cisco Secure Firewall Management Center software, identify which systems are reachable from adjacent networks, and immediately restrict management and data-plane access to trusted segments using ACLs and network segmentation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today