EUVD-2026-81130
GHSA-4jm7-46ch-h63w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged device credentials
-
DeliveryReach ASA/FTD/FMC management interface
-
ExploitSend crafted request bypassing access-control check
-
ExecutionEscalate scope beyond authorized boundary
-
ImpactCompromise appliance confidentiality/integrity/availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires low-privileged authenticated access to Cisco Secure ASA, FTD, or FMC software (CVSS PR:L) reachable over the network (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific vulnerable feature is not disclosed - the advisory groups multiple internally-found CWE-284 improper-access-control defects under a single hardening release - so no exact configuration toggle is identified. The key limiting factor is that an attacker must first possess valid credentials on the device; unauthenticated exploitation is not indicated by the vector. Affected versions span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1; upgrading to the fixed hardening release removes the exposure. |
| Impact | CVSS 3.1 base is 9.9 (Critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - network-reachable, low complexity, only low privileges required, no user interaction, and a scope change yielding full confidentiality/integrity/availability loss. However, this is a grouped software-hardening advisory (cisco-sa-hardening-asaftdfmc-uvpPROhN) covering multiple internally-discovered CWE-284 improper-access-control issues found by Cisco's own engineering review, not a single dedicated vuln with a discrete root cause. The description provides no exploitation mechanics, so the 9.9/S:C impact is vendor-asserted and cannot be independently validated. Mitigating the raw score: no EPSS probability, no KEV listing, and no public POC are present in the data - exploitation status is 'no public exploit identified at time of analysis,' and PR:L means an attacker must first hold valid (even if low-privileged) credentials on the device. Reported internally by Cisco with no evidence of in-the-wild activity, this reads as a proactively-patched, high-severity-on-paper issue rather than a currently exploited priority; the PR:L authentication requirement is the single biggest real-world limiter. One notable tension worth verifying with the vendor: the 'Authentication Bypass' tag conflicts with the PR:L vector - a genuine auth bypass would be PR:N, so the tag is loose. |
| Exploit ScenarioDerived | An attacker who already holds low-privileged authenticated access to an affected ASA, FTD, or FMC device (e.g., a limited operator account or a foothold on the management plane) sends crafted requests that exploit an improper access-control check to act outside their authorized scope, gaining control over resources they should not reach. Because CVSS marks scope-changed with full C/I/A impact, successful exploitation could compromise the security appliance and, for FMC, cascade to the FTD devices it manages. No public exploit code is available, and exploitation requires valid credentials, constraining opportunistic attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileged attacker with network reachability to escalate privileges and achieve a full loss of confidentiality, integrity, and availability, with a scope change that extends the impact beyond the vulnerable component itself (CVSS 3.1 base 9.9, Critical). The issues were uncovered during Cisco's internal security review and are shipped as a grouped hardening fix rather than tied to one named feature, so no single vulnerable configuration toggle is disclosed. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the very broad affected version range (ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, FMC 7.0 through 10.0.1) means unpatched appliances remain exposed to any attacker who already holds valid low-privileged credentials.
RemediationAI
Cisco addresses these defects through a software hardening release documented in advisory cisco-sa-hardening-asaftdfmc-uvpPROhN (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN): upgrade ASA, FTD, and FMC to the fixed builds named in that advisory - patch available per vendor advisory, and the exact fixed version numbers per release train are not enumerated in the provided data, so consult the advisory before upgrading. Because exploitation requires low-privileged authenticated access (CVSS PR:L) with no user interaction, the most effective compensating control is to restrict reachability of the management interfaces of ASA, FTD, and FMC to trusted administrative networks only (dedicated out-of-band management VLANs, management-access ACLs, or interface-level access lists), accepting the trade-off that remote administration from other networks becomes impossible. Additionally, reduce the attack surface by eliminating or tightly scoping low-privileged local accounts and redundant accounts on the appliances and the FMC, since any valid credential is a foothold; this limits the pool of potential attackers but can impede operational workflows that rely on delegated read-only access. Where immediate upgrades are not possible, monitor and alert on unexpected configuration changes, privilege-level changes, or API calls from low-privileged FMC/ASA/FTD accounts, as these would indicate attempted abuse; this is detection-only and does not remove the underlying defect. Note that these access-control issues are grouped under CWE-284 and no individual feature toggle is disclosed, so disabling a single service cannot be relied upon as a full mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability class is CWE-284 (Improper Access Control), the CWE pillar that aggregates authorization weaknesses such as missing or incorrect permission checks, privilege-assignment errors, and authentication-bypass conditions; the associated tags explicitly flag it as an authentication bypass-style flaw. Because it is a pillar-level CWE, the advisory deliberately groups multiple internally discovered access-control defects across three distinct products into one hardening release: Cisco Secure Adaptive Security Appliance (ASA) software, Cisco Secure Firewall Threat Defense (FTD) software, and Cisco Secure Firewall Management Center (FMC), each represented in the CPE data as cpe:2.3:a:cisco:cisco_secure_firewall_adaptive_security_appliance_(asa)_software, cpe:2.3:a:cisco:cisco_secure_firewall_threat_defense_(ftd)_software, and cpe:2.3:a:cisco:cisco_secure_firewall_management_center_(fmc). ASA and FTD are the data-plane firewall platforms while FMC is the centralized management plane, so a shared access-control defect across them is significant: the management center governs policy and configuration for many managed devices. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H places the flaw as remotely reachable with low complexity and no user interaction, requires only low privileges, and produces a scope change (S:C) - meaning successful exploitation can affect resources beyond the originally authorized security scope, which is consistent with privilege escalation or bypass of an authorization boundary rather than a simple crash or information leak.
Know when Cisco Secure Firewall Adaptive Security Appliance Asa Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable management plane with low-priv auth (PR:L) and no UI; accepting Cisco's vendor-asserted scope change and full C/I/A impact given no per-vuln detail to dispute it.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20332 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.
Executive ViewAI
A critical access-control flaw in Cisco Secure Firewall ASA, FTD, and FMC software allows an already-authenticated low-privileged user to escalate to full administrative control of the firewall estate, with impact extending beyond the appliance itself into the network segments it protects. Because no patch is currently available and the affected version range spans nearly every supported ASA, FTD, and FMC release, any organization operating these platforms with unpatched appliances carries elevated risk of an insider or compromised-credential actor converting limited access into a full breach of confidentiality, integrity, and availability. Leadership should treat this as a priority containment and monitoring exercise rather than a routine patch cycle, given that perimeter and segmentation controls are directly in scope.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce multi-factor authentication and strict least-privilege role assignment on all ASA, FTD, and FMC management interfaces; restrict management-plane reachability to dedicated jump hosts and trusted network ranges; disable or remove dormant and unnecessary low-privileged accounts; enable and monitor logging for privilege escalation, new administrative accounts, and configuration changes; and apply network segmentation to limit blast radius should an appliance be compromised.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to r
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be trigge
Exploit-DB