Cisco Secure Firewall Adaptive Security Appliance Asa Software
Monthly
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software addresses a class of internally discovered defects grouped under CVE-2026-20333, described as incorrect comparison conditions (CWE-697) that can lead to high confidentiality, integrity, and availability impact (CVSS 8.8). Affected deployments span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1, and exploitation requires network reachability to the affected management/data plane plus valid low-privilege credentials (CVSS vector PR:L), so this is not an unauthenticated remote attack. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); Cisco resolved it proactively through the cisco-sa-hardening-asaftdfmc-uvpPROhN advisory rather than in response to a reported incident.
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software can be triggered by an attacker who already holds high-privilege administrative credentials and who can also induce a separate user interaction, potentially yielding high confidentiality, integrity, and availability impact that crosses a security scope boundary (CVSS 8.4, CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H). The affected trains span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1. Cisco addressed these issues as a grouped hardening release (CWE-710, Improper Adherence to Coding Standards) rather than a single disclosed flaw; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileged attacker with network reachability to escalate privileges and achieve a full loss of confidentiality, integrity, and availability, with a scope change that extends the impact beyond the vulnerable component itself (CVSS 3.1 base 9.9, Critical). The issues were uncovered during Cisco's internal security review and are shipped as a grouped hardening fix rather than tied to one named feature, so no single vulnerable configuration toggle is disclosed. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the very broad affected version range (ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, FMC 7.0 through 10.0.1) means unpatched appliances remain exposed to any attacker who already holds valid low-privileged credentials.
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU utilization, degrading or interrupting traffic handling in an availability-only denial of service. The defect is in the rate-limiting path for syslog message 419002, which is generated at high volume during SYN floods and is not throttled correctly, so the logging/rate-limiting process keeps consuming CPU instead of shedding the excess events. The issue is remotely reachable and unauthenticated (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) and covers a wide installed base of ASA 9.16.x-9.23.x and FTD 7.0.x-7.7.x releases; Cisco rates it 8.6 (scope-changed) whereas our independent assessment rates it 7.5 because impact remains confined to the affected device (S:U) with no confidentiality or integrity loss, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to reload the device by flooding crafted EIGRP update messages, triggering a memory leak that accumulates until the appliance restarts. The flaw is only reachable when EIGRP dynamic routing is configured and active on an interface - it is not present in default configurations - and the attacker must sit within the same Layer-2 broadcast domain/EIGRP adjacency, so the attack cannot be launched across the internet. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the independent assessment rates this a genuine but bounded availability risk (CVSS 7.4, AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) because sustained, high-rate traffic is required rather than a single packet.
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco Secure Firewall ASA, FTD, and FMC software to potentially achieve full confidentiality, integrity, and availability impact (CVSS 8.8). The vulnerabilities were internally discovered and addressed in a Cisco hardening release; the exact affected feature is not publicly detailed, and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured for certificate-based IKEv2 authentication, causing an unexpected device reload and a denial-of-service condition. Exploitation requires no credentials and no user interaction; the only prerequisite is a specific configuration - IKEv2 VPN with certificate authentication enabled and the IKEv2 listener (typically UDP/500 and UDP/4500) reachable from the attacker's network, which is common on internet-facing VPN concentrators. At time of analysis there is no public exploit identified, no CISA KEV listing, and the issue is availability-only (CVSS 8.6, C:N/I:N/A:H with scope change because the process crash escalates to a full device reload); devices without IKEv2 certificate authentication are not affected.
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat Defense (FTD) Software, and Secure Firewall Management Center (FMC) Software can be triggered by remote, unauthenticated attackers over the network and may result in high confidentiality, integrity, and availability impact across affected firewalls and their management plane. Cisco rates the group at CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but the vector's AC:H reflects that exploitation depends on attacker-uncontrolled conditions - reliably producing the precise malformed input that causes the miscalculation is the practical barrier, and the bundled advisory names no single feature, protocol, or configuration toggle as a prerequisite. The flaws were found during Cisco's own internal hardening review, so there is no public exploit identified at time of analysis and no CISA KEV listing; remediation is delivered through Cisco's hardening release rather than awaiting out-of-band emergency fixes.
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software on 3100 Series and 4200 Series appliances, where a crafted stream of DTLS traffic causes improper resource management and forces the device to reload. The CVSS 3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), reflecting that no credentials or user interaction are required and that the impact is purely availability, though the scope change acknowledges the disruption extends beyond the vulnerable component itself. At time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, so exploitation requires either opportunistic scanning of exposed DTLS listeners or targeted traffic against internet-facing firewalls.
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) software can let a low-privilege, authenticated remote attacker cause high-impact confidentiality, integrity, and availability effects on affected appliances, with information disclosure flagged among the affected weaknesses. Cisco scores the bundled issues 9.9 under CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, where the scope change (S:C) and complete C/I/A impact push the rating into critical territory despite requiring a valid low-privilege credential and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the fixes were produced through an internal hardening review rather than in response to observed attacks, so real-world urgency cannot be confirmed from the available signals.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software allows a remote, low-privilege authenticated attacker to achieve full confidentiality, integrity, and availability impact with a scope change, per the vendor's CVSS 9.9 rating. Exploitation requires an existing low-privilege session on a reachable ASA, FTD, or FMC instance (PR:L) but no user interaction and only low attack complexity; anonymous attackers cannot trigger it directly. The advisory is a grouped hardening release covering multiple internally discovered issues, so the exact triggering feature or configuration is not disclosed; no public exploit was identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
Unauthenticated access control bypass in Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense (FTD) software lets a remote attacker send traffic that the device's access control list is supposed to block, potentially reaching hosts on protected networks. Exploitation is conditional: the device must have an ACL configured with Object Group Search (OGS) enabled and object groups populated into group access control policies, a logic error in that population step causes the wrong policy to be applied. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), while no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV) - the practical risk is moderate and configuration-dependent rather than a critical emergency.
Access-control bypass in Cisco Secure Firewall ASA and Threat Defense (FTD) software allows an unauthenticated, remote attacker to push traffic that should be blocked through the device and reach hosts in networks the firewall is meant to protect. The defect is a logic error in how group access control policies (ACPs) are populated when the Access Control List Object Group Search (OGS) feature is enabled, so it only manifests on devices that both enable OGS and rely on group objects in their ACLs. Cisco rates it 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) with limited integrity impact and scope change, no public exploit code has been identified at time of analysis, and the configuration dependency keeps real-world exposure below the raw score for most deployments.
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be triggered by a crafted DNS reply, causing the device to reload and resulting in a denial-of-service condition. The attacker must be able to respond to DNS queries originating from the device-either by controlling the DNS service or via a machine-in-the-middle position-and the device must use DNS over TCP. No public exploit code has been identified at the time of analysis, and the CVSS score is 6.8 (Medium) with only availability impact.
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software addresses a class of internally discovered defects grouped under CVE-2026-20333, described as incorrect comparison conditions (CWE-697) that can lead to high confidentiality, integrity, and availability impact (CVSS 8.8). Affected deployments span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1, and exploitation requires network reachability to the affected management/data plane plus valid low-privilege credentials (CVSS vector PR:L), so this is not an unauthenticated remote attack. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); Cisco resolved it proactively through the cisco-sa-hardening-asaftdfmc-uvpPROhN advisory rather than in response to a reported incident.
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software can be triggered by an attacker who already holds high-privilege administrative credentials and who can also induce a separate user interaction, potentially yielding high confidentiality, integrity, and availability impact that crosses a security scope boundary (CVSS 8.4, CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H). The affected trains span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1. Cisco addressed these issues as a grouped hardening release (CWE-710, Improper Adherence to Coding Standards) rather than a single disclosed flaw; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileged attacker with network reachability to escalate privileges and achieve a full loss of confidentiality, integrity, and availability, with a scope change that extends the impact beyond the vulnerable component itself (CVSS 3.1 base 9.9, Critical). The issues were uncovered during Cisco's internal security review and are shipped as a grouped hardening fix rather than tied to one named feature, so no single vulnerable configuration toggle is disclosed. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the very broad affected version range (ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, FMC 7.0 through 10.0.1) means unpatched appliances remain exposed to any attacker who already holds valid low-privileged credentials.
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU utilization, degrading or interrupting traffic handling in an availability-only denial of service. The defect is in the rate-limiting path for syslog message 419002, which is generated at high volume during SYN floods and is not throttled correctly, so the logging/rate-limiting process keeps consuming CPU instead of shedding the excess events. The issue is remotely reachable and unauthenticated (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) and covers a wide installed base of ASA 9.16.x-9.23.x and FTD 7.0.x-7.7.x releases; Cisco rates it 8.6 (scope-changed) whereas our independent assessment rates it 7.5 because impact remains confined to the affected device (S:U) with no confidentiality or integrity loss, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to reload the device by flooding crafted EIGRP update messages, triggering a memory leak that accumulates until the appliance restarts. The flaw is only reachable when EIGRP dynamic routing is configured and active on an interface - it is not present in default configurations - and the attacker must sit within the same Layer-2 broadcast domain/EIGRP adjacency, so the attack cannot be launched across the internet. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the independent assessment rates this a genuine but bounded availability risk (CVSS 7.4, AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) because sustained, high-rate traffic is required rather than a single packet.
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco Secure Firewall ASA, FTD, and FMC software to potentially achieve full confidentiality, integrity, and availability impact (CVSS 8.8). The vulnerabilities were internally discovered and addressed in a Cisco hardening release; the exact affected feature is not publicly detailed, and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured for certificate-based IKEv2 authentication, causing an unexpected device reload and a denial-of-service condition. Exploitation requires no credentials and no user interaction; the only prerequisite is a specific configuration - IKEv2 VPN with certificate authentication enabled and the IKEv2 listener (typically UDP/500 and UDP/4500) reachable from the attacker's network, which is common on internet-facing VPN concentrators. At time of analysis there is no public exploit identified, no CISA KEV listing, and the issue is availability-only (CVSS 8.6, C:N/I:N/A:H with scope change because the process crash escalates to a full device reload); devices without IKEv2 certificate authentication are not affected.
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat Defense (FTD) Software, and Secure Firewall Management Center (FMC) Software can be triggered by remote, unauthenticated attackers over the network and may result in high confidentiality, integrity, and availability impact across affected firewalls and their management plane. Cisco rates the group at CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but the vector's AC:H reflects that exploitation depends on attacker-uncontrolled conditions - reliably producing the precise malformed input that causes the miscalculation is the practical barrier, and the bundled advisory names no single feature, protocol, or configuration toggle as a prerequisite. The flaws were found during Cisco's own internal hardening review, so there is no public exploit identified at time of analysis and no CISA KEV listing; remediation is delivered through Cisco's hardening release rather than awaiting out-of-band emergency fixes.
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software on 3100 Series and 4200 Series appliances, where a crafted stream of DTLS traffic causes improper resource management and forces the device to reload. The CVSS 3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), reflecting that no credentials or user interaction are required and that the impact is purely availability, though the scope change acknowledges the disruption extends beyond the vulnerable component itself. At time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, so exploitation requires either opportunistic scanning of exposed DTLS listeners or targeted traffic against internet-facing firewalls.
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) software can let a low-privilege, authenticated remote attacker cause high-impact confidentiality, integrity, and availability effects on affected appliances, with information disclosure flagged among the affected weaknesses. Cisco scores the bundled issues 9.9 under CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, where the scope change (S:C) and complete C/I/A impact push the rating into critical territory despite requiring a valid low-privilege credential and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the fixes were produced through an internal hardening review rather than in response to observed attacks, so real-world urgency cannot be confirmed from the available signals.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software allows a remote, low-privilege authenticated attacker to achieve full confidentiality, integrity, and availability impact with a scope change, per the vendor's CVSS 9.9 rating. Exploitation requires an existing low-privilege session on a reachable ASA, FTD, or FMC instance (PR:L) but no user interaction and only low attack complexity; anonymous attackers cannot trigger it directly. The advisory is a grouped hardening release covering multiple internally discovered issues, so the exact triggering feature or configuration is not disclosed; no public exploit was identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
Unauthenticated access control bypass in Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense (FTD) software lets a remote attacker send traffic that the device's access control list is supposed to block, potentially reaching hosts on protected networks. Exploitation is conditional: the device must have an ACL configured with Object Group Search (OGS) enabled and object groups populated into group access control policies, a logic error in that population step causes the wrong policy to be applied. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), while no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV) - the practical risk is moderate and configuration-dependent rather than a critical emergency.
Access-control bypass in Cisco Secure Firewall ASA and Threat Defense (FTD) software allows an unauthenticated, remote attacker to push traffic that should be blocked through the device and reach hosts in networks the firewall is meant to protect. The defect is a logic error in how group access control policies (ACPs) are populated when the Access Control List Object Group Search (OGS) feature is enabled, so it only manifests on devices that both enable OGS and rely on group objects in their ACLs. Cisco rates it 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) with limited integrity impact and scope change, no public exploit code has been identified at time of analysis, and the configuration dependency keeps real-world exposure below the raw score for most deployments.
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be triggered by a crafted DNS reply, causing the device to reload and resulting in a denial-of-service condition. The attacker must be able to respond to DNS queries originating from the device-either by controlling the DNS service or via a machine-in-the-middle position-and the device must use DNS over TCP. No public exploit code has been identified at the time of analysis, and the CVSS score is 6.8 (Medium) with only availability impact.