EUVD-2026-81119
GHSA-w3f5-j392-38wg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent network foothold
-
DeliverySend crafted traffic to firewall interface
-
ExploitTrigger improper resource-lifetime flaw (CWE-664)
-
ExecutionCorrupt/exhaust resource state
-
ImpactAchieve high-impact compromise of device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource lifecycle control
|
| Exploitation Conditions | Requires the attacker to be on an adjacent network (AV:A) - the same L2 broadcast domain or a logically adjacent segment such as the appliance's management network - reachable to the ASA/FTD/FMC software; it does NOT require authentication (PR:N) or user interaction (UI:N). The limiting factor is network position: unlike a fully routable network flaw, an internet-based attacker cannot reach it without first gaining a foothold on an adjacent segment. Applies to Cisco Secure Firewall ASA (9.16.x-9.24.x), FTD (7.0.x-10.0.0), and FMC (7.0.x-10.0.1) running vulnerable builds prior to the hardening release; the exact vulnerable feature is not disclosed because the advisory groups multiple internal findings under CWE-664. |
| Impact | This is a member of Cisco's bundled hardening release for ASA/FTD/FMC (advisory cisco-sa-hardening-asaftdfmc-uvpPROhN), grouped under the abstract Pillar weakness CWE-664 (improper control of a resource through its lifetime), so the underlying flaw is described only at a high level and not attributable to a single concrete bug. The vendor CVSS 3.1 vector (8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is notable versus its siblings: this one is UNAUTHENTICATED (PR:N) but ADJACENT (AV:A) rather than fully network-routable, whereas siblings CVE-2026-20329/20330 are AV:N but require authentication (PR:L). The adjacency requirement (same L2/logical segment) is a meaningful mitigant - an enterprise firewall's management/adjacent plane is not typically internet-exposed - which is why the vendor did not rate this 9.x. There is no EPSS score, no CISA KEV listing, and no public POC in the supplied data, so there is no signal of active or imminent exploitation; the reporter is Cisco's own internal engineering review, which historically means low weaponization likelihood at disclosure. Net: this is a genuinely high-impact-if-reachable issue on a security-critical product, but the adjacent vector plus absence of any exploitation evidence places it below the internet-facing unauthenticated criticals. The 'Information Disclosure' tag understates the vendor-asserted C:H/I:H/A:H (full compromise), so treat impact by the CVSS vector, not the tag. Key caveat: because the advisory groups multiple internal findings under one abstract CWE, the precise trigger and affected component cannot be independently verified from the data provided. |
| Exploit ScenarioDerived | An attacker positioned on a network segment adjacent to the firewall's reachable interface (e.g., a management VLAN or an inside segment) sends crafted traffic that abuses a resource-lifetime flaw (such as use-after-free, double-free, or improper resource release) in the ASA/FTD/FMC software, requiring no credentials. Successful exploitation yields high confidentiality, integrity, and availability impact on the affected node. No public exploit code is identified at time of analysis; the issue was found internally by Cisco. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco Secure Firewall ASA, FTD, and FMC software to potentially achieve full confidentiality, integrity, and availability impact (CVSS 8.8). The vulnerabilities were internally discovered and addressed in a Cisco hardening release; the exact affected feature is not publicly detailed, and no public exploit code has been identified at time of analysis.
RemediationAI
Apply the hardening update described in Cisco advisory cisco-sa-hardening-asaftdfmc-uvpPROhN (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN). The advisory references a software hardening release that addresses these vulnerabilities; exact fixed version numbers are not specified in the available data, so consult the advisory for the appropriate patched release per platform. Until patching is possible, restrict network access to the appliances so that only trusted hosts on adjacent segments can reach the management and data interfaces, as the flaws require an attacker to be on an adjacent network (AV:A). Strong network segmentation and monitoring for anomalous traffic from adjacent segments can reduce exposure, but these are compensating controls and do not eliminate the vulnerability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-664 is a high-level Pillar weakness covering improper control of a resource through its lifetime, including issues like use-after-free, double-free, and improper cleanup. Cisco's advisory groups multiple internally discovered findings under this category for Cisco Secure Firewall ASA, FTD, and FMC software, so the specific underlying bugs are not individually disclosed. The CVSS vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates the flaws are exploitable from an adjacent network without authentication or user interaction, with high impact to confidentiality, integrity, and availability. CPE data confirms affected products include Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software.
Know when Cisco Secure Firewall Adaptive Security Appliance Asa Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent unauthenticated vector per vendor (AV:A/PR:N); accepting vendor-asserted C:H/I:H/A:H and S:U for a resource-lifetime flaw on the device itself, though the grouped advisory prevents independent metric verification.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20336 are related to issues concerning improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.
Executive ViewAI
Cisco Secure Firewall ASA, FTD, and FMC environments face a high-severity vulnerability that could allow an adjacent-network attacker to compromise confidentiality, integrity, and availability. Because these platforms enforce network segmentation and perimeter security, successful exploitation could weaken broader security controls and expose sensitive traffic or management access. Leadership should prioritize exposure reduction, vendor coordination, and monitoring while no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting adjacent-network access to Cisco Secure Firewall ASA, FTD, and FMC management and data interfaces; enforcing segmentation and least-privilege management access; disabling or restricting nonessential features and remote management; monitoring firewall, FTD, and FMC logs for anomalous resource, crash, or configuration behavior; and engaging Cisco TAC for hardening guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to r
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be trigge
Exploit-DB