EUVD-2026-81097
GHSA-pqgf-vf8p-j3x9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege account on ASA/FTD/FMC
-
DeliverySend crafted request over network
-
ExploitTrigger improper neutralization (CWE-707)
-
ExecutionCross security scope boundary
-
ImpactFull device compromise (C/I/A:H)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V1 - Encoding and Sanitization Improper neutralization
|
| Exploitation Conditions | Requires a network path to the ASA/FTD/FMC and a valid low-privilege credential (PR:L) - not fully unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The advisory does not name the specific feature, protocol, or configuration that must be enabled, because it bundles multiple internally found CWE-707 issues; defenders cannot determine from this advisory whether a non-default feature or particular management interface is the trigger. Practical limiting factors: the attacker must already hold some authenticated foothold on the appliance, and exposure is greatest where the management plane or affected data-plane service is reachable. Verify the exact affected/fixed versions and any per-CVE conditions against the Cisco advisory before assessing your deployment. |
| Impact | This is a high-priority-on-paper item whose real-world urgency is hard to confirm from available signals. The vendor CVSS of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) describes a network-reachable, low-complexity flaw needing only low-privilege authentication, with a scope change and full confidentiality/integrity/availability impact - the classic shape of an authenticated-to-full-compromise firewall bug. However, this is a grouped 'software hardening release' advisory covering MULTIPLE internally discovered issues under the CWE-707 pillar (improper neutralization), so the single 9.9 vector is Cisco-asserted for the worst-case member and cannot be mapped to a specific, verified primitive. No EPSS score, no CISA KEV listing, and no public POC are present in the input, and the flaws were found by Cisco's own engineering team rather than observed in attacks - consistent with proactive internal review rather than active exploitation. Net: treat as a genuine patch priority for Internet-facing ASA/FTD/FMC given the AV:N/PR:L/S:C shape, but note the impact granularity is unverified and there is no evidence of exploitation. Conflicting signal to flag: the 'Information Disclosure' tag understates the vector, since I:H and A:H imply tampering/availability loss well beyond disclosure. |
| Exploit ScenarioDerived | An attacker with low-privilege authenticated access to an Internet-reachable Cisco ASA, FTD, or FMC management/data plane sends crafted input that is improperly neutralized (CWE-707 injection-class), triggering execution or manipulation that crosses a security boundary (S:C) to compromise confidentiality, integrity, and availability. No public exploit code is identified at time of analysis, and the vulnerabilities were disclosed by Cisco's internal review rather than from observed attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) software can let a low-privilege, authenticated remote attacker cause high-impact confidentiality, integrity, and availability effects on affected appliances, with information disclosure flagged among the affected weaknesses. Cisco scores the bundled issues 9.9 under CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, where the scope change (S:C) and complete C/I/A impact push the rating into critical territory despite requiring a valid low-privilege credential and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the fixes were produced through an internal hardening review rather than in response to observed attacks, so real-world urgency cannot be confirmed from the available signals.
RemediationAI
Patch available per vendor advisory: Cisco states that a software hardening release addresses these internally discovered issues, and the authoritative fixed-version matrix (which differs across ASA, FTD, and FMC) is published in Cisco Security Advisory cisco-sa-hardening-asaftdfmc-uvpPROhN at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN - consult it for the exact release to install on each platform before upgrading, because the source data for this CVE does not enumerate specific fix versions. Until upgrades are complete, prioritize the practical limiting factors: the vector requires a valid low-privilege credential (PR:L), so aggressive identity hygiene is the highest-value control - enforce MFA on all AAA/VPN and FMC administrative logins, remove or disable dormant and service accounts, and tighten role assignments so few identities hold even low-privilege access to the appliances. Restrict network reachability to the management plane (FMC GUI/API, ASA/FTD management and SSH/HTTPS interfaces) to dedicated administrative VLANs or jump hosts and block it from user segments, accepting that this will break remote or distributed administration workflows and must be paired with out-of-band access. Rate-limit and log authentication attempts and enable detailed audit logging forwarded off-box to a SIEM, since the advisory does not identify the triggering protocol or feature - meaning signature- or rule-based detection of the specific exploit is not possible from this data, and behavioral detection of anomalous post-authentication activity is the realistic fallback. Because POC availability and KEV status are absent rather than confirmed negative, continue to monitor the Cisco advisory for updates and re-assess if exploit code or exploitation reporting emerges.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected platforms share a substantial common codebase and management surface: Cisco Secure Firewall ASA is the long-standing stateful firewall, VPN, and remote-access appliance; Cisco Secure Firewall Threat Defense (FTD) is the next-generation firewall built on that foundation; and Cisco Secure Firewall Management Center (FMC) is the centralized management and event-analysis console for FTD and related devices. The CPE data lists all three as wildcard-versioned affected products (cpe:2.3:a:cisco:cisco_secure_firewall_adaptive_security_appliance_(asa)_software, ..._threat_defense_(ftd)_software, and ..._management_center_(fmc)), which means the advisory does not pin the flaw to a single build in the source data. The assigned weakness is CWE-707 (Improper Neutralization), a pillar-level class that parents the injection and neutralization-failure weaknesses (for example improper neutralization of special elements used in commands, queries, or output), so the root cause is best understood as input that is not correctly sanitized or escaped before it is interpreted by a downstream component. Because Cisco grouped several internally discovered issues under this one CVE as part of a hardening release, the advisory does not enumerate the specific feature, protocol, port, or configuration that triggers each individual defect, which materially complicates exposure assessment for defenders.
Know when Cisco Secure Firewall Adaptive Security Appliance Asa Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Accepting the vendor shape: network-reachable, low-complexity, requires a low-privilege account (PR:L), with improper-neutralization crossing a trust boundary (S:C) yielding full C/I/A impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20330 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707.
Executive ViewAI
Cisco Secure Firewall ASA, Firepower Threat Defense (FTD), and Firepower Management Center (FMC) - the perimeter enforcement and management layer for much of the enterprise network - are affected by a critical-severity bundle of flaws tracked as CVE-2026-20330. An attacker who already holds any valid low-privilege account on these systems could achieve full loss of confidentiality, integrity, and availability on the appliance itself, meaning policy tampering, configuration and traffic exposure, and potential outage of connectivity that dependent business services rely on. No vendor patch is currently available and
No vendor-released patch identified at time of analysis. Interim mitigations: restrict management-plane reachability to dedicated trusted networks or jump hosts and remove any internet exposure of management interfaces; enforce multi-factor authentication and eliminate or rotate unused and shared low-privilege accounts; apply strict least-privilege role assignments on ASA, FTD, and FMC; enable detailed logging and alerting on configuration changes, account activity, and data movement; retain offline, current configuration backups to support rapid rebuild and integrity comparison; and monitor the Cisco advisory so fixed releases are deployed under change control as soon as they are published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to r
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be trigge
Exploit-DB