Cisco Secure Firewall Threat Defense Ftd Software
Monthly
Denial of service in the Cisco Snort 3 detection engine allows remote, unauthenticated attackers to exhaust device resources and disrupt inspection services on any deployment actively processing attacker-influenced traffic - including Cisco Secure Firewall Threat Defense (FTD), the Cisco UTD Snort IPS engine, Cisco Cyber Vision, and upstream Open Source Snort 3. The flaw is rooted in uncontrolled resource consumption (CWE-400) and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning only availability is impacted - there is no confidentiality or integrity loss and no code execution. No public exploit code or in-the-wild activity has been identified at time of analysis, and no CISA KEV listing exists; exploitation is gated by the requirement that the target actually sits inline as an IDS/IPS or firewall in a traffic-inspection path.
Remote denial of service in Cisco Snort 3-based inspection engines, including Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine Software, Cisco Cyber Vision, and open-source Snort 3, allows unauthenticated remote attackers to crash or disrupt the inspection process by sending crafted traffic that triggers incorrect calculation errors (CWE-682). CVSS 3.1 scores this 7.5 High with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is availability-only with no confidentiality or integrity effect; exploitation requires the attacker's traffic to traverse an actively inspecting sensor. No KEV entry or public exploit data was supplied, and no public exploit identified at time of analysis.
Improper privilege management in Cisco Snort 3 allows a locally authenticated low-privilege attacker to escalate privileges on affected deployments, including Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine, Cisco Cyber Vision, and Open Source Snort 3 installations. Exploitation requires an existing local foothold (AV:L, PR:L) with no user interaction, so the practical risk is post-compromise privilege escalation or abuse of malicious low-privilege local accounts rather than remote attack. No public exploit identified at time of analysis; no CISA KEV active-exploitation confirmation was provided.
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memory in any deployment where Snort 3 parses attacker-reachable network traffic, potentially leading to arbitrary code execution or a denial-of-service condition in the inspection process. The affected code ships not only as the standalone open-source Snort 3 project but also embedded in Cisco Secure Firewall Threat Defense (FTD), the Cisco UTD Snort IPS engine, and Cisco Cyber Vision, so exposure spans both Cisco appliances and third-party deployments of the open-source engine. Cisco addressed the issues through hardening releases produced during an internal security review, but the advisory groups the findings without publishing per-defect trigger details, and no public exploit code has been identified at time of analysis; CVSS AC:H reflects that an attacker must land traffic on the specific vulnerable parsing path rather than send a trivially repeatable packet.
Unauthenticated adjacent attackers who can reach the sftunnel inter-device management channel can impersonate the peer device and register as an sftunnel peer on Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) Software, gaining manager-role privileges equivalent to root. Because the flaw is improper TLS certificate management in the protocol itself, default configurations are affected and no authentication or user interaction is required, but the attack only succeeds if the sftunnel connection is already down or can be disrupted long enough for the crafted-certificate handshake to complete (scored CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, 8.3). No public exploit code has been identified at time of analysis and no EPSS score was supplied, so this is a serious, high-impact, but pre-exploitation issue that should be patched on a prioritized basis, especially where the FMC/FTD management plane is not isolated on a dedicated out-of-band network.
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software addresses a class of internally discovered defects grouped under CVE-2026-20333, described as incorrect comparison conditions (CWE-697) that can lead to high confidentiality, integrity, and availability impact (CVSS 8.8). Affected deployments span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1, and exploitation requires network reachability to the affected management/data plane plus valid low-privilege credentials (CVSS vector PR:L), so this is not an unauthenticated remote attack. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); Cisco resolved it proactively through the cisco-sa-hardening-asaftdfmc-uvpPROhN advisory rather than in response to a reported incident.
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software can be triggered by an attacker who already holds high-privilege administrative credentials and who can also induce a separate user interaction, potentially yielding high confidentiality, integrity, and availability impact that crosses a security scope boundary (CVSS 8.4, CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H). The affected trains span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1. Cisco addressed these issues as a grouped hardening release (CWE-710, Improper Adherence to Coding Standards) rather than a single disclosed flaw; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileged attacker with network reachability to escalate privileges and achieve a full loss of confidentiality, integrity, and availability, with a scope change that extends the impact beyond the vulnerable component itself (CVSS 3.1 base 9.9, Critical). The issues were uncovered during Cisco's internal security review and are shipped as a grouped hardening fix rather than tied to one named feature, so no single vulnerable configuration toggle is disclosed. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the very broad affected version range (ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, FMC 7.0 through 10.0.1) means unpatched appliances remain exposed to any attacker who already holds valid low-privileged credentials.
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU utilization, degrading or interrupting traffic handling in an availability-only denial of service. The defect is in the rate-limiting path for syslog message 419002, which is generated at high volume during SYN floods and is not throttled correctly, so the logging/rate-limiting process keeps consuming CPU instead of shedding the excess events. The issue is remotely reachable and unauthenticated (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) and covers a wide installed base of ASA 9.16.x-9.23.x and FTD 7.0.x-7.7.x releases; Cisco rates it 8.6 (scope-changed) whereas our independent assessment rates it 7.5 because impact remains confined to the affected device (S:U) with no confidentiality or integrity loss, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to reload the device by flooding crafted EIGRP update messages, triggering a memory leak that accumulates until the appliance restarts. The flaw is only reachable when EIGRP dynamic routing is configured and active on an interface - it is not present in default configurations - and the attacker must sit within the same Layer-2 broadcast domain/EIGRP adjacency, so the attack cannot be launched across the internet. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the independent assessment rates this a genuine but bounded availability risk (CVSS 7.4, AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) because sustained, high-rate traffic is required rather than a single packet.
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled reload and denying service to everything the appliance protects. The flaw is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 8.6) and triggers during or after the TLS 1.3 handshake, so any TLS 1.3-enabled listening socket reachable by an attacker is a candidate target - including both data-traffic and user-management listeners. Cisco has published an advisory for this issue; no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, but the low complexity and network reachability required make it a realistic DoS vector against internet-exposed appliances.
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco Secure Firewall ASA, FTD, and FMC software to potentially achieve full confidentiality, integrity, and availability impact (CVSS 8.8). The vulnerabilities were internally discovered and addressed in a Cisco hardening release; the exact affected feature is not publicly detailed, and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured for certificate-based IKEv2 authentication, causing an unexpected device reload and a denial-of-service condition. Exploitation requires no credentials and no user interaction; the only prerequisite is a specific configuration - IKEv2 VPN with certificate authentication enabled and the IKEv2 listener (typically UDP/500 and UDP/4500) reachable from the attacker's network, which is common on internet-facing VPN concentrators. At time of analysis there is no public exploit identified, no CISA KEV listing, and the issue is availability-only (CVSS 8.6, C:N/I:N/A:H with scope change because the process crash escalates to a full device reload); devices without IKEv2 certificate authentication are not affected.
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat Defense (FTD) Software, and Secure Firewall Management Center (FMC) Software can be triggered by remote, unauthenticated attackers over the network and may result in high confidentiality, integrity, and availability impact across affected firewalls and their management plane. Cisco rates the group at CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but the vector's AC:H reflects that exploitation depends on attacker-uncontrolled conditions - reliably producing the precise malformed input that causes the miscalculation is the practical barrier, and the bundled advisory names no single feature, protocol, or configuration toggle as a prerequisite. The flaws were found during Cisco's own internal hardening review, so there is no public exploit identified at time of analysis and no CISA KEV listing; remediation is delivered through Cisco's hardening release rather than awaiting out-of-band emergency fixes.
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) software lets an unauthenticated, remote attacker drive an affected appliance toward a denial-of-service condition by sending crafted TLS frames during connection setup. The exposure is broad, covering FMC and FTD builds across the 7.0.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x, 7.7.x and 10.0.x trains, and Cisco rates it 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) while our own assessment scores the same vector with scope unchanged (S:U) as a genuine but bounded availability risk - no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, so the practical barrier is deployment topology rather than exploit sophistication: an attacker must obtain network reachability to the sftunnel listener on TCP/8305, which normally lives on a restricted management or out-of-band segment shared only between an FMC and its managed FTD devices.
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software on 3100 Series and 4200 Series appliances, where a crafted stream of DTLS traffic causes improper resource management and forces the device to reload. The CVSS 3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), reflecting that no credentials or user interaction are required and that the impact is purely availability, though the scope change acknowledges the disruption extends beyond the vulnerable component itself. At time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, so exploitation requires either opportunistic scanning of exposed DTLS listeners or targeted traffic against internet-facing firewalls.
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) software can let a low-privilege, authenticated remote attacker cause high-impact confidentiality, integrity, and availability effects on affected appliances, with information disclosure flagged among the affected weaknesses. Cisco scores the bundled issues 9.9 under CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, where the scope change (S:C) and complete C/I/A impact push the rating into critical territory despite requiring a valid low-privilege credential and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the fixes were produced through an internal hardening review rather than in response to observed attacks, so real-world urgency cannot be confirmed from the available signals.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software allows a remote, low-privilege authenticated attacker to achieve full confidentiality, integrity, and availability impact with a scope change, per the vendor's CVSS 9.9 rating. Exploitation requires an existing low-privilege session on a reachable ASA, FTD, or FMC instance (PR:L) but no user interaction and only low attack complexity; anonymous attackers cannot trigger it directly. The advisory is a grouped hardening release covering multiple internally discovered issues, so the exact triggering feature or configuration is not disclosed; no public exploit was identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt remediation.
Memory management flaws in Cisco Snort 3's file-processing path allow remote, unauthenticated attackers to exhaust memory and force unexpected Detection Engine restarts, interrupting packet inspection on affected open-source Snort 3 and Cisco Secure Firewall Threat Defense deployments. The issue is rated CVSS 5.8 (moderate) with a scope change and availability-only impact; no public exploit was identified at time of analysis, and Cisco has published an advisory. Sustained delivery of files to an inspection point with file policy enabled is required, so exposure is greatest on inline sensors actively inspecting untrusted traffic.
An infinite-loop flaw in the Snort 3 Detection Engine's GTP codec lets remote, unauthenticated attackers restart the detection engine and disrupt inspection by sending a single crafted, fragmented UDP datagram carrying GTP extension headers (CVSS 5.3, availability-only, CWE-835). Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) software, and Cisco UTD Snort IPS Engine software are all affected, but only deployments that actually inspect GTP traffic - typically mobile-core, telecom, or specifically configured sensor placements - are realistically reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, and the outcome is a temporary detection-engine restart rather than host compromise; the practical risk is a window of lost or degraded inspection coverage.
Improper handling of nested GRE traffic in the Snort 3 Detection Engine allows unauthenticated, remote attackers to crash and restart the engine by sending a crafted GRE payload through an affected device, causing either an inspection bypass or a transient denial of service depending on how the device is configured. Affected deployments include Cisco Secure Firewall Threat Defense (FTD), the Cisco UTD Snort IPS Engine, Cisco Cyber Vision, the Cisco Umbrella Insights virtual appliance, and open-source Snort 3. No public exploit code or confirmed active exploitation was identified at time of analysis; the engine restarts automatically, so disruption is transient per triggering packet, keeping this a moderate-severity availability issue rather than a top-tier priority.
Cisco Snort 3's Teredo detection engine can be forced to restart by a crafted Teredo packet, interrupting packet inspection on Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD Snort IPS Engine Software deployments that actually inspect Teredo traffic. The issue is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L), but impact is availability-only: a temporary engine restart and inspection gap rather than persistent compromise or code execution. No public exploit was identified at time of analysis, and exploitation depends on the target's Snort engine receiving and parsing Teredo packets.
Unauthenticated remote attackers can force the Snort 3 Detection Engine in Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine, and open-source Snort 3 to restart by sending crafted VBA data through traffic the engine inspects, producing a denial-of-service condition. The flaw is a stack-based buffer overflow (CWE-121) caused by improper range checking in the Snort 3 VBA Decompression Engine; exploitation requires Snort 3 inspection with VBA decompression enabled and visibility of attacker traffic. No public exploit was identified at time of analysis, and the assessed impact is limited to availability with a CVSS score of 5.8.
Crafted GRE packets can cause Cisco Snort 3's Detection Engine to restart, temporarily interrupting packet inspection in Cisco Secure Firewall Threat Defense, the Cisco UTD Snort IPS engine, and open-source Snort 3 deployments that inspect GRE traffic. The issue is incomplete error checking during GRE parsing and is reachable by unauthenticated remote attackers with no user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L). No public exploit was identified at time of analysis, and the practical constraint is that the malicious GRE packet must traverse a Snort-inspected path.
Denial of service in Cisco Snort 3 allows an unauthenticated, remote attacker to restart the detection engine by sending a single crafted UDP NetFlow packet, interrupting packet inspection. The issue affects Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD Snort IPS Engine Software when NetFlow detection is active and the crafted packet reaches the parser; Cisco rates it CVSS 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/A:L). This is a moderate-priority availability issue, with no public exploit identified at time of analysis, and exploitation depends on NetFlow traffic being in the sensor's inspection path.
Denial of service in Cisco Snort 3 allows unauthenticated remote attackers to restart the Snort 3 Detection Engine by sending crafted SMTP packets with malformed MIME header fields over an established connection. The defect is missing error checking during SMTP MIME header parsing (CWE-805), and successful exploitation only affects availability, forcing a restart that can briefly interrupt inspection. Affected deployments include Cisco Open Source Snort3, Secure Firewall Threat Defense (FTD) software, and UTD Snort IPS Engine software that actively inspect SMTP traffic; no public exploit has been identified at time of analysis.
Unauthenticated access control bypass in Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense (FTD) software lets a remote attacker send traffic that the device's access control list is supposed to block, potentially reaching hosts on protected networks. Exploitation is conditional: the device must have an ACL configured with Object Group Search (OGS) enabled and object groups populated into group access control policies, a logic error in that population step causes the wrong policy to be applied. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), while no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV) - the practical risk is moderate and configuration-dependent rather than a critical emergency.
Access-control bypass in Cisco Secure Firewall ASA and Threat Defense (FTD) software allows an unauthenticated, remote attacker to push traffic that should be blocked through the device and reach hosts in networks the firewall is meant to protect. The defect is a logic error in how group access control policies (ACPs) are populated when the Access Control List Object Group Search (OGS) feature is enabled, so it only manifests on devices that both enable OGS and rely on group objects in their ACLs. Cisco rates it 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) with limited integrity impact and scope change, no public exploit code has been identified at time of analysis, and the configuration dependency keeps real-world exposure below the raw score for most deployments.
Denial of service in Cisco Secure Firewall Threat Defense (FTD) can be triggered remotely without authentication when the legacy Snort 2 Detection Engine parses a crafted SSL/TLS certificate during connection setup, causing the engine to restart unexpectedly. The flaw affects FTD releases running Snort 2 and processing SSL policy inspection; the provided assessment rates it CVSS 3.1 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L), so impact is limited to a transient availability loss rather than code execution or data compromise. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE.
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be triggered by a crafted DNS reply, causing the device to reload and resulting in a denial-of-service condition. The attacker must be able to respond to DNS queries originating from the device-either by controlling the DNS service or via a machine-in-the-middle position-and the device must use DNS over TCP. No public exploit code has been identified at the time of analysis, and the CVSS score is 6.8 (Medium) with only availability impact.
Denial of service in the Cisco Snort 3 detection engine allows remote, unauthenticated attackers to exhaust device resources and disrupt inspection services on any deployment actively processing attacker-influenced traffic - including Cisco Secure Firewall Threat Defense (FTD), the Cisco UTD Snort IPS engine, Cisco Cyber Vision, and upstream Open Source Snort 3. The flaw is rooted in uncontrolled resource consumption (CWE-400) and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning only availability is impacted - there is no confidentiality or integrity loss and no code execution. No public exploit code or in-the-wild activity has been identified at time of analysis, and no CISA KEV listing exists; exploitation is gated by the requirement that the target actually sits inline as an IDS/IPS or firewall in a traffic-inspection path.
Remote denial of service in Cisco Snort 3-based inspection engines, including Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine Software, Cisco Cyber Vision, and open-source Snort 3, allows unauthenticated remote attackers to crash or disrupt the inspection process by sending crafted traffic that triggers incorrect calculation errors (CWE-682). CVSS 3.1 scores this 7.5 High with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is availability-only with no confidentiality or integrity effect; exploitation requires the attacker's traffic to traverse an actively inspecting sensor. No KEV entry or public exploit data was supplied, and no public exploit identified at time of analysis.
Improper privilege management in Cisco Snort 3 allows a locally authenticated low-privilege attacker to escalate privileges on affected deployments, including Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine, Cisco Cyber Vision, and Open Source Snort 3 installations. Exploitation requires an existing local foothold (AV:L, PR:L) with no user interaction, so the practical risk is post-compromise privilege escalation or abuse of malicious low-privilege local accounts rather than remote attack. No public exploit identified at time of analysis; no CISA KEV active-exploitation confirmation was provided.
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memory in any deployment where Snort 3 parses attacker-reachable network traffic, potentially leading to arbitrary code execution or a denial-of-service condition in the inspection process. The affected code ships not only as the standalone open-source Snort 3 project but also embedded in Cisco Secure Firewall Threat Defense (FTD), the Cisco UTD Snort IPS engine, and Cisco Cyber Vision, so exposure spans both Cisco appliances and third-party deployments of the open-source engine. Cisco addressed the issues through hardening releases produced during an internal security review, but the advisory groups the findings without publishing per-defect trigger details, and no public exploit code has been identified at time of analysis; CVSS AC:H reflects that an attacker must land traffic on the specific vulnerable parsing path rather than send a trivially repeatable packet.
Unauthenticated adjacent attackers who can reach the sftunnel inter-device management channel can impersonate the peer device and register as an sftunnel peer on Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) Software, gaining manager-role privileges equivalent to root. Because the flaw is improper TLS certificate management in the protocol itself, default configurations are affected and no authentication or user interaction is required, but the attack only succeeds if the sftunnel connection is already down or can be disrupted long enough for the crafted-certificate handshake to complete (scored CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, 8.3). No public exploit code has been identified at time of analysis and no EPSS score was supplied, so this is a serious, high-impact, but pre-exploitation issue that should be patched on a prioritized basis, especially where the FMC/FTD management plane is not isolated on a dedicated out-of-band network.
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software addresses a class of internally discovered defects grouped under CVE-2026-20333, described as incorrect comparison conditions (CWE-697) that can lead to high confidentiality, integrity, and availability impact (CVSS 8.8). Affected deployments span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1, and exploitation requires network reachability to the affected management/data plane plus valid low-privilege credentials (CVSS vector PR:L), so this is not an unauthenticated remote attack. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); Cisco resolved it proactively through the cisco-sa-hardening-asaftdfmc-uvpPROhN advisory rather than in response to a reported incident.
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software can be triggered by an attacker who already holds high-privilege administrative credentials and who can also induce a separate user interaction, potentially yielding high confidentiality, integrity, and availability impact that crosses a security scope boundary (CVSS 8.4, CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H). The affected trains span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1. Cisco addressed these issues as a grouped hardening release (CWE-710, Improper Adherence to Coding Standards) rather than a single disclosed flaw; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileged attacker with network reachability to escalate privileges and achieve a full loss of confidentiality, integrity, and availability, with a scope change that extends the impact beyond the vulnerable component itself (CVSS 3.1 base 9.9, Critical). The issues were uncovered during Cisco's internal security review and are shipped as a grouped hardening fix rather than tied to one named feature, so no single vulnerable configuration toggle is disclosed. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the very broad affected version range (ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, FMC 7.0 through 10.0.1) means unpatched appliances remain exposed to any attacker who already holds valid low-privileged credentials.
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU utilization, degrading or interrupting traffic handling in an availability-only denial of service. The defect is in the rate-limiting path for syslog message 419002, which is generated at high volume during SYN floods and is not throttled correctly, so the logging/rate-limiting process keeps consuming CPU instead of shedding the excess events. The issue is remotely reachable and unauthenticated (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) and covers a wide installed base of ASA 9.16.x-9.23.x and FTD 7.0.x-7.7.x releases; Cisco rates it 8.6 (scope-changed) whereas our independent assessment rates it 7.5 because impact remains confined to the affected device (S:U) with no confidentiality or integrity loss, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to reload the device by flooding crafted EIGRP update messages, triggering a memory leak that accumulates until the appliance restarts. The flaw is only reachable when EIGRP dynamic routing is configured and active on an interface - it is not present in default configurations - and the attacker must sit within the same Layer-2 broadcast domain/EIGRP adjacency, so the attack cannot be launched across the internet. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the independent assessment rates this a genuine but bounded availability risk (CVSS 7.4, AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) because sustained, high-rate traffic is required rather than a single packet.
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled reload and denying service to everything the appliance protects. The flaw is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 8.6) and triggers during or after the TLS 1.3 handshake, so any TLS 1.3-enabled listening socket reachable by an attacker is a candidate target - including both data-traffic and user-management listeners. Cisco has published an advisory for this issue; no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, but the low complexity and network reachability required make it a realistic DoS vector against internet-exposed appliances.
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco Secure Firewall ASA, FTD, and FMC software to potentially achieve full confidentiality, integrity, and availability impact (CVSS 8.8). The vulnerabilities were internally discovered and addressed in a Cisco hardening release; the exact affected feature is not publicly detailed, and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured for certificate-based IKEv2 authentication, causing an unexpected device reload and a denial-of-service condition. Exploitation requires no credentials and no user interaction; the only prerequisite is a specific configuration - IKEv2 VPN with certificate authentication enabled and the IKEv2 listener (typically UDP/500 and UDP/4500) reachable from the attacker's network, which is common on internet-facing VPN concentrators. At time of analysis there is no public exploit identified, no CISA KEV listing, and the issue is availability-only (CVSS 8.6, C:N/I:N/A:H with scope change because the process crash escalates to a full device reload); devices without IKEv2 certificate authentication are not affected.
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat Defense (FTD) Software, and Secure Firewall Management Center (FMC) Software can be triggered by remote, unauthenticated attackers over the network and may result in high confidentiality, integrity, and availability impact across affected firewalls and their management plane. Cisco rates the group at CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but the vector's AC:H reflects that exploitation depends on attacker-uncontrolled conditions - reliably producing the precise malformed input that causes the miscalculation is the practical barrier, and the bundled advisory names no single feature, protocol, or configuration toggle as a prerequisite. The flaws were found during Cisco's own internal hardening review, so there is no public exploit identified at time of analysis and no CISA KEV listing; remediation is delivered through Cisco's hardening release rather than awaiting out-of-band emergency fixes.
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) software lets an unauthenticated, remote attacker drive an affected appliance toward a denial-of-service condition by sending crafted TLS frames during connection setup. The exposure is broad, covering FMC and FTD builds across the 7.0.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x, 7.7.x and 10.0.x trains, and Cisco rates it 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) while our own assessment scores the same vector with scope unchanged (S:U) as a genuine but bounded availability risk - no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, so the practical barrier is deployment topology rather than exploit sophistication: an attacker must obtain network reachability to the sftunnel listener on TCP/8305, which normally lives on a restricted management or out-of-band segment shared only between an FMC and its managed FTD devices.
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software on 3100 Series and 4200 Series appliances, where a crafted stream of DTLS traffic causes improper resource management and forces the device to reload. The CVSS 3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), reflecting that no credentials or user interaction are required and that the impact is purely availability, though the scope change acknowledges the disruption extends beyond the vulnerable component itself. At time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, so exploitation requires either opportunistic scanning of exposed DTLS listeners or targeted traffic against internet-facing firewalls.
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) software can let a low-privilege, authenticated remote attacker cause high-impact confidentiality, integrity, and availability effects on affected appliances, with information disclosure flagged among the affected weaknesses. Cisco scores the bundled issues 9.9 under CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, where the scope change (S:C) and complete C/I/A impact push the rating into critical territory despite requiring a valid low-privilege credential and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the fixes were produced through an internal hardening review rather than in response to observed attacks, so real-world urgency cannot be confirmed from the available signals.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software allows a remote, low-privilege authenticated attacker to achieve full confidentiality, integrity, and availability impact with a scope change, per the vendor's CVSS 9.9 rating. Exploitation requires an existing low-privilege session on a reachable ASA, FTD, or FMC instance (PR:L) but no user interaction and only low attack complexity; anonymous attackers cannot trigger it directly. The advisory is a grouped hardening release covering multiple internally discovered issues, so the exact triggering feature or configuration is not disclosed; no public exploit was identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt remediation.
Memory management flaws in Cisco Snort 3's file-processing path allow remote, unauthenticated attackers to exhaust memory and force unexpected Detection Engine restarts, interrupting packet inspection on affected open-source Snort 3 and Cisco Secure Firewall Threat Defense deployments. The issue is rated CVSS 5.8 (moderate) with a scope change and availability-only impact; no public exploit was identified at time of analysis, and Cisco has published an advisory. Sustained delivery of files to an inspection point with file policy enabled is required, so exposure is greatest on inline sensors actively inspecting untrusted traffic.
An infinite-loop flaw in the Snort 3 Detection Engine's GTP codec lets remote, unauthenticated attackers restart the detection engine and disrupt inspection by sending a single crafted, fragmented UDP datagram carrying GTP extension headers (CVSS 5.3, availability-only, CWE-835). Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) software, and Cisco UTD Snort IPS Engine software are all affected, but only deployments that actually inspect GTP traffic - typically mobile-core, telecom, or specifically configured sensor placements - are realistically reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, and the outcome is a temporary detection-engine restart rather than host compromise; the practical risk is a window of lost or degraded inspection coverage.
Improper handling of nested GRE traffic in the Snort 3 Detection Engine allows unauthenticated, remote attackers to crash and restart the engine by sending a crafted GRE payload through an affected device, causing either an inspection bypass or a transient denial of service depending on how the device is configured. Affected deployments include Cisco Secure Firewall Threat Defense (FTD), the Cisco UTD Snort IPS Engine, Cisco Cyber Vision, the Cisco Umbrella Insights virtual appliance, and open-source Snort 3. No public exploit code or confirmed active exploitation was identified at time of analysis; the engine restarts automatically, so disruption is transient per triggering packet, keeping this a moderate-severity availability issue rather than a top-tier priority.
Cisco Snort 3's Teredo detection engine can be forced to restart by a crafted Teredo packet, interrupting packet inspection on Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD Snort IPS Engine Software deployments that actually inspect Teredo traffic. The issue is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L), but impact is availability-only: a temporary engine restart and inspection gap rather than persistent compromise or code execution. No public exploit was identified at time of analysis, and exploitation depends on the target's Snort engine receiving and parsing Teredo packets.
Unauthenticated remote attackers can force the Snort 3 Detection Engine in Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine, and open-source Snort 3 to restart by sending crafted VBA data through traffic the engine inspects, producing a denial-of-service condition. The flaw is a stack-based buffer overflow (CWE-121) caused by improper range checking in the Snort 3 VBA Decompression Engine; exploitation requires Snort 3 inspection with VBA decompression enabled and visibility of attacker traffic. No public exploit was identified at time of analysis, and the assessed impact is limited to availability with a CVSS score of 5.8.
Crafted GRE packets can cause Cisco Snort 3's Detection Engine to restart, temporarily interrupting packet inspection in Cisco Secure Firewall Threat Defense, the Cisco UTD Snort IPS engine, and open-source Snort 3 deployments that inspect GRE traffic. The issue is incomplete error checking during GRE parsing and is reachable by unauthenticated remote attackers with no user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L). No public exploit was identified at time of analysis, and the practical constraint is that the malicious GRE packet must traverse a Snort-inspected path.
Denial of service in Cisco Snort 3 allows an unauthenticated, remote attacker to restart the detection engine by sending a single crafted UDP NetFlow packet, interrupting packet inspection. The issue affects Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD Snort IPS Engine Software when NetFlow detection is active and the crafted packet reaches the parser; Cisco rates it CVSS 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/A:L). This is a moderate-priority availability issue, with no public exploit identified at time of analysis, and exploitation depends on NetFlow traffic being in the sensor's inspection path.
Denial of service in Cisco Snort 3 allows unauthenticated remote attackers to restart the Snort 3 Detection Engine by sending crafted SMTP packets with malformed MIME header fields over an established connection. The defect is missing error checking during SMTP MIME header parsing (CWE-805), and successful exploitation only affects availability, forcing a restart that can briefly interrupt inspection. Affected deployments include Cisco Open Source Snort3, Secure Firewall Threat Defense (FTD) software, and UTD Snort IPS Engine software that actively inspect SMTP traffic; no public exploit has been identified at time of analysis.
Unauthenticated access control bypass in Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense (FTD) software lets a remote attacker send traffic that the device's access control list is supposed to block, potentially reaching hosts on protected networks. Exploitation is conditional: the device must have an ACL configured with Object Group Search (OGS) enabled and object groups populated into group access control policies, a logic error in that population step causes the wrong policy to be applied. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), while no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV) - the practical risk is moderate and configuration-dependent rather than a critical emergency.
Access-control bypass in Cisco Secure Firewall ASA and Threat Defense (FTD) software allows an unauthenticated, remote attacker to push traffic that should be blocked through the device and reach hosts in networks the firewall is meant to protect. The defect is a logic error in how group access control policies (ACPs) are populated when the Access Control List Object Group Search (OGS) feature is enabled, so it only manifests on devices that both enable OGS and rely on group objects in their ACLs. Cisco rates it 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) with limited integrity impact and scope change, no public exploit code has been identified at time of analysis, and the configuration dependency keeps real-world exposure below the raw score for most deployments.
Denial of service in Cisco Secure Firewall Threat Defense (FTD) can be triggered remotely without authentication when the legacy Snort 2 Detection Engine parses a crafted SSL/TLS certificate during connection setup, causing the engine to restart unexpectedly. The flaw affects FTD releases running Snort 2 and processing SSL policy inspection; the provided assessment rates it CVSS 3.1 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L), so impact is limited to a transient availability loss rather than code execution or data compromise. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE.
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be triggered by a crafted DNS reply, causing the device to reload and resulting in a denial-of-service condition. The attacker must be able to respond to DNS queries originating from the device-either by controlling the DNS service or via a machine-in-the-middle position-and the device must use DNS over TCP. No public exploit code has been identified at the time of analysis, and the CVSS score is 6.8 (Medium) with only availability impact.