CVE-2026-20015
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA and FTD Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device, potentially impacting availability of services to other devices in the network. This is due to a memory leak when parsing IKEv2 packets. An attacker could send crafted IKEv2 packets, exhausting resources and eventually requiring manual reload.
Risk Assessment
An attack could cause device unavailability, potentially affecting services across the network, leading to operational disruptions. Manual reload is required, extending downtime.
Recommendation
Apply Cisco updates for ASA and FTD. Restrict access to IKEv2 services and monitor device memory usage.
Other vulnerabilities in Cisco Secure Firewall ASA/FTD Software
See all- CVE-2026-20250High
Vulnerability in DTLS message handling of Cisco Secure Firewall ASA and FTD Software for 3100 and 4200 Series devices allows an unauthenticated, remote attacker to cause a DoS condition. This is due to improper resource management when processing certain DTLS messages.
- CVE-2026-20249High
Vulnerability in the certification authentication feature of IKEv2 for Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to cause an unexpected device reload. This is due to a logic error during the certificate authentication phase of IKEv2 connection setup.
- CVE-2026-20222High
Vulnerability in the EIGRP implementation in Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, adjacent attacker to cause an unexpected device reload, resulting in a DoS condition. This is due to improper resource management when handling EIGRP update messages.
- CVE-2026-20154High
Vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to cause high CPU utilization, resulting in a DoS condition. This is due to improper rate limiting for syslog message 419002.
- CVE-2026-20024Medium
A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA and FTD software allows an authenticated, adjacent attacker to cause an unexpected device reload, resulting in a DoS condition. The issue is due to heap corruption when parsing OSPF packets.
- CVE-2026-20106Medium
A vulnerability in the Remote Access SSL VPN, HTTP management, and MUS functionality of Cisco Secure Firewall ASA and FTD Software could allow an unauthenticated, remote attacker to exhaust device memory, resulting in a denial of service (DoS) condition requiring a manual reboot. This is due to trusting user input without validation. An attacker could exploit this by sending crafted packets to the Remote Access SSL VPN server.
- CVE-2026-20013Medium
A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA and FTD Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device, potentially impacting availability of services to other devices in the network. This is due to memory exhaustion caused by not freeing memory during IKEv2 packet processing. An attacker could send crafted IKEv2 packets, exhausting resources and eventually requiring manual reload.
Original NVD description (English source)
A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device that may impact the availability of services to devices elsewhere in the network. This vulnerability is due to a memory leak when parsing IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker to exhaust resources, causing a DoS condition that will eventually require the device to be manually reloaded.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS