EUVD-2026-81135
GHSA-rq53-m697-2mf8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege ASA/FTD/FMC access
-
DeliverySend crafted request over network
-
ExploitTrigger incorrect-comparison logic flaw
-
ExecutionBypass intended security check
-
ImpactRead/modify protected data and disrupt service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incorrect comparison
|
| Exploitation Conditions | Requires network reachability to the management/data plane of Cisco Secure ASA, FTD, or FMC software AND valid low-privilege credentials (PR:L) - this is not remotely exploitable by an unauthenticated attacker. No user interaction is needed (UI:N) and no non-default feature toggle is named; the flaw is a bundled 'incorrect comparison condition' (CWE-697) addressed in a hardening release. Limiting factors: the authentication requirement, the scope-unchanged nature (S:U), and the fact that details are aggregated in a grouped advisory rather than a specific reproducible trigger. Affected trains span ASA 9.16-9.24, FTD 7.0-10.0.0, and FMC 7.0-10.0.1; upgrading to the corresponding fixed hardening builds removes exposure. |
| Impact | Vendor CVSS is 8.8 (High) via CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - network-reachable, low complexity, but requiring some level of authentication (PR:L) and asserting full C:H/I:H/A:H impact without scope change. No EPSS score, no CISA KEV listing, and no public POC are present in the intelligence, so the exploitation status is 'no public exploit identified at time of analysis.' A significant caveat: this is a grouped software-hardening advisory (cisco-sa-hardening-asaftdfmc-uvpPROhN) covering multiple internally-discovered issues bundled under CWE-697 (incorrect comparison), so the vector is vendor-asserted at the aggregate level rather than tied to a specific demonstrated exploit - the precise trigger and the reason a comparison flaw yields full compromise are not detailed. The C:H/I:H/A:H triad conflicts with the single 'Information Disclosure' tag, which understates impact. Relative to same-advisory siblings, this CVE is S:U/8.8 whereas CVE-2026-20329/20330/20332 are S:C/9.9, and it is authenticated (PR:L) unlike the adjacent-unauth CVE-2026-20336; that places it mid-tier. Net: a real patch-priority item for exposed Cisco firewall fleets given the high impact and low attack complexity, but the authentication requirement, absence of any exploitation signal, and the vague grouped-advisory framing argue against treating it as an emergency ahead of the unauthenticated or S:C members of the same release. |
| Exploit ScenarioDerived | An attacker who already holds valid low-privilege credentials (or a foothold on a management-plane account) on a Cisco Secure ASA, FTD, or FMC device sends a crafted request that exploits an incorrect comparison condition, bypassing an intended check to read or alter protected data and disrupt the appliance. No public exploit code or active exploitation is reported, and exploitation requires authentication, so realistic risk is highest where firewall management interfaces are broadly reachable and low-tier accounts are loosely controlled. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software addresses a class of internally discovered defects grouped under CVE-2026-20333, described as incorrect comparison conditions (CWE-697) that can lead to high confidentiality, integrity, and availability impact (CVSS 8.8). Affected deployments span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1, and exploitation requires network reachability to the affected management/data plane plus valid low-privilege credentials (CVSS vector PR:L), so this is not an unauthenticated remote attack. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); Cisco resolved it proactively through the cisco-sa-hardening-asaftdfmc-uvpPROhN advisory rather than in response to a reported incident.
RemediationAI
Patch available per vendor advisory: Cisco published this as a software hardening release, and the authoritative remediation is to upgrade each affected platform to the fixed build within its train as listed in the advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN - affected trains are ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1, and exact fixed versions should be taken from that advisory rather than inferred. Because exploitation requires network reachability and at least low-privilege authenticated access (CVSS PR:L), interim compensating controls should focus on shrinking that reach: restrict administrative and management-plane access to the FMC, ASA, and FTD interfaces to a hardened, dedicated management subnet or jump host and remove management access from user or internet-facing segments, understanding that this complicates out-of-band administration and remote operations; enforce least privilege and audit local and AAA accounts so that low-privilege credentials cannot be used broadly, at the cost of additional account-governance overhead; and monitor firewall, FMC, and ASA logs for anomalous policy-evaluation or configuration-change activity that could indicate a comparison-logic bypass. Cisco also recommends following its standard firewall hardening guidance (disabling unused services, tightening access lists on management interfaces, and enabling logging to a central collector), but none of these workarounds fully replaces applying the vendor's fixed builds, which is the only complete removal of exposure. No vendor-released workaround is documented as a substitute for the upgrade, and no public exploit code has been identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-20333 is a coverage CVE for a software hardening release rather than a single isolated bug. Cisco's engineering teams conducted an internal security review across three related platforms - Cisco Secure ASA Software (cpe:2.3:a:cisco:cisco_secure_firewall_adaptive_security_appliance_(asa)_software), Cisco Secure Firewall Management Center (cpe:2.3:a:cisco:cisco_secure_firewall_management_center_(fmc)), and Cisco Secure Firewall Threat Defense Software (cpe:2.3:a:cisco:cisco_secure_firewall_threat_defense_(ftd)_software) - and the findings were bundled under the Common Weakness Enumeration Pillar CWE-697, 'Incorrect Comparison'. CWE-697 is a pillar-level weakness, meaning the underlying defects are of the family where a value is compared incorrectly: wrong operand, wrong operator (for example an equality check used where a range or inequality check is required), or an incorrect bound, boundary, or sign in a conditional. In a firewall and firewall-management context such comparisons typically gate access-control decisions, policy/rule evaluation, session or connection state checks, authentication and authorization logic, and configuration validation. When such a check evaluates incorrectly, the consequence is a logic-level bypass or an erroneously granted/denied action rather than a memory-safety corruption, which aligns with the assessed scope-unchanged (S:U) high confidentiality, integrity, and availability impact. Because the advisory aggregates multiple internally discovered issues rather than publishing a specific, reproducible trigger, the exact code paths are not enumerated, and the practical attack surface is the network-reachable management and data plane of ASA, FTD, and FMC, reachable only by a caller that has already obtained some level of authentication (PR:L).
Know when Cisco Secure Firewall Adaptive Security Appliance Asa Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Accept Cisco's vector: network-reachable management interface (AV:N/AC:L), low-privilege auth required (PR:L), no UI, no scope change (S:U), with vendor-asserted full C:H/I:H/A:H impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20333 are related to incorrect comparison conditions that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-697.
Executive ViewAI
Cisco Secure Firewall deployments running ASA Software (9.16-9.24), FTD Software (7.0-10.0.0), or FMC Software (7.0-10.0.1) are exposed to a class of internally discovered comparison-condition defects tracked as CVE-2026-20333, which carry maximum confidentiality, integrity, and availability impact at CVSS 8.8. Cisco released this as a proactive hardening advisory, not in response to an incident, and no vendor-released patch has been identified at time of analysis - meaning perimeter and segmentation controls currently carry the full weight of defense. Security leadership should treat this as a standing exposure in the network security control plane itself: because these platforms are the enforcement point for the organization's segmentation strategy, a compromise here would degrade trust in downstream controls, and exploitation requires only valid low-privilege credentials plus network reachability to the affected management or data plane.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict management-plane and data-plane access to trusted administrative segments and jump hosts only; enforce MFA and least privilege on all accounts with reachability to affected devices, given the PR:L (authenticated) prerequisite; minimize and monitor low-privilege account populations; forward ASA/FTD/FMC logs to the SIEM with alerting on anomalous reads, auth events, and configuration changes; and isolate or further segment affected appliances until a fixed build is published under cisco-sa-hardening-asaftdfmc-uvpPROhN.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to r
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be trigge
Exploit-DB