EUVD-2026-81095
GHSA-p9gc-crmq-wcr6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege authenticated access
-
ExploitSend crafted request triggering exceptional condition
-
ExecutionImproper error handling causes scope change
-
ImpactCompromise confidentiality, integrity, and availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling framework
|
| Exploitation Conditions | Requires an existing low-privilege authenticated session (PR:L) on a Cisco Secure ASA, FTD, or FMC instance reachable over the network (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L). Exploitation depends on reaching a code path that improperly handles an exceptional condition (CWE-703); the vendor asserts a resulting scope change (S:C). The primary limiting factor is the authentication requirement - anonymous, unauthenticated attackers cannot exploit it directly. Because this is a grouped hardening advisory, the exact triggering feature, interface, or configuration is not specified in the available data, so defenders should treat any authenticated user of these management/data-plane interfaces as within scope. |
| Impact | The vendor assigns CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), implying a low-privilege authenticated attacker can remotely achieve a scope change with full confidentiality, integrity, and availability impact - a critical rating. However, several signals temper this: there is NO EPSS score, NO CISA KEV listing, and NO public POC provided, so there is no evidence of active or imminent exploitation. Critically, this CVE derives from a grouped internal 'security hardening' advisory covering multiple internally-discovered issues bucketed under the CWE-703 Pillar (improper handling of exceptional conditions), so the C:H/I:H/A:H and S:C values are vendor-asserted against a vague, non-specific weakness rather than a discretely described flaw - the impact and scope-change claims cannot be independently verified from the single reference. The saving grace for defenders is PR:L: exploitation requires an existing authenticated foothold on the management/data plane, not anonymous access. Net: treat as a real patch priority given the affected products' security-critical role and the high vendor score, but the absence of exploitation signals suggests this is a proactive hardening fix rather than an actively-targeted threat. The 'Information Disclosure' tag understates the asserted impact (which includes integrity and availability). |
| Exploit ScenarioDerived | An attacker who already holds low-privilege authenticated access to a Cisco Secure ASA, FTD, or FMC instance sends crafted input that triggers an improperly-handled exceptional condition, causing a scope change (S:C) that lets them affect resources beyond their authorized boundary. No public exploit code is identified at time of analysis, and no user interaction is required (UI:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software allows a remote, low-privilege authenticated attacker to achieve full confidentiality, integrity, and availability impact with a scope change, per the vendor's CVSS 9.9 rating. Exploitation requires an existing low-privilege session on a reachable ASA, FTD, or FMC instance (PR:L) but no user interaction and only low attack complexity; anonymous attackers cannot trigger it directly. The advisory is a grouped hardening release covering multiple internally discovered issues, so the exact triggering feature or configuration is not disclosed; no public exploit was identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
RemediationAI
Patch available per vendor advisory: apply the fixed software releases documented in Cisco Security Advisory cisco-sa-hardening-asaftdfmc-uvpPROhN (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN) for all affected ASA Software, FTD Software, and FMC Software instances; the advisory is a hardening release and enumerates the specific remediated builds per platform branch. Because the vector requires an authenticated session (PR:L) and no public exploit was identified at time of analysis, priority should still be high given the 9.9 severity and scope change, but interim controls can reduce exposure: restrict network reachability to ASA, FTD, and FMC management interfaces via management-network segmentation, ACLs, or out-of-band administration VLANs (trade-off: can complicate legitimate remote administration and may require jump hosts); enforce least privilege and tightly audit low-privilege accounts that could serve as the required authenticated foothold (trade-off: administrative overhead, and unused accounts must be disabled to be effective); and enable logging/alerting on exception and management-plane events for detection of anomalous authenticated activity. These compensating controls only reduce attack surface and do not eliminate the underlying weakness, so upgrading remains the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is grouped under CWE-703 (Improper Check or Handling of Exceptional Conditions), a pillar-level weakness class covering failures to detect, propagate, or safely recover from error and exception states. In the context of Cisco's firewall platforms, such defects typically arise when an unexpected error, malformed state, or failed operation is not handled correctly, allowing execution to continue down an unintended code path. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates the vulnerable code is reachable over the network with only low privileges and no user interaction, and that the vendor asserts a scope change (S:C) - meaning a compromise of the vulnerable component can affect resources beyond its own security authority, such as the underlying firewall data plane or management boundary. CPE entries confirm the affected components are Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software, all wildcarded for version, so exact affected builds must be confirmed against the referenced Cisco advisory. Because this is a consolidated internal-hardening release rather than a single disclosed defect, the specific protocol, interface, or feature that triggers the exceptional-condition mishandling is not identified in the available data.
Know when Cisco Secure Firewall Adaptive Security Appliance Asa Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Retaining the vendor vector: authenticated (PR:L) remote (AV:N) access with asserted scope change and full CIA impact; specifics are unverifiable, so I defer to vendor metrics.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20329 are related to issues concerning improper handling of exceptional conditions that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-703.
Executive ViewAI
Cisco Secure Firewall ASA, Threat Defense (FTD), and Firewall Management Center (FMC) platforms are affected by CVE-2026-20329, a critical (CVSS 9.9) flaw that lets an attacker who already holds a low-privilege account on a reachable appliance escalate to full compromise of the device's confidentiality, integrity, and availability. Because these systems are the enforcement points and management plane for the organization's network perimeter and segmentation controls, a successful exploit could allow an authenticated insider or a holder of compromised low-privilege credentials to disable enforcement, alter policy, or pivot into protected segments. Leadership should care because remediation is not yet available from the vendor and the affected devices are security-critical infrastructure that typically cannot be taken offline.
No vendor-released patch identified at time of analysis; interim mitigations are network and identity controls: restrict ASA, FTD, and FMC management and remote-access interfaces to a hardened out-of-band management network reachable only from trusted administrative hosts, remove or disable unused management services and interfaces, reduce and monitor low-privilege account populations on the affected appliances, enforce multi-factor authentication for all sessions, and enable detailed logging and alerting on configuration and policy changes to detect post-exploitation activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to r
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be trigge
Exploit-DB