CVE-2026-20073
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should be denied through an affected device. The issue is due to improper error handling when a device joining a cluster runs out of memory while replicating access control rules.
Risk Assessment
An attacker could bypass access controls and reach devices in protected networks, potentially leading to unauthorized access to sensitive resources.
Recommendation
Apply Cisco updates for ASA and FTD. Monitor memory usage in clusters and ensure adequate resources.
Other vulnerabilities in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
See all- CVE-2026-20082High
A vulnerability in the handling of connection limits in Cisco Secure Firewall ASA could allow an unauthenticated, remote attacker to incorrectly drop incoming TCP SYN packets. An attacker could exploit this vulnerability to block all incoming TCP connections to the device.
- CVE-2026-20100High
A vulnerability in the LUA interpreter of the Remote Access SSL VPN feature of Cisco Secure Firewall ASA and FTD Software could allow an authenticated, remote attacker with a valid VPN connection to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
- CVE-2025-20127High
A vulnerability in the TLS 1.3 implementation for a specific cipher for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software for Firepower 3100 and 4200 Series devices could allow an authenticated, remote attacker to consume resources associated with incoming TLS 1.3 connections, eventually causing the device to stop accepting any new SSL/TLS or VPN requests. The issue is due to the implementation of the TLS 1.3 Cipher TLS_CHACHA20_POLY1305_SHA256. Sending a large number of TLS 1.3 connections with this cipher can cause a DoS condition where no new incoming encrypted connections are accepted. The device must be reloaded to clear this condition.
Original NVD description (English source)
A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should be denied through an affected device. This vulnerability is due to improper error handling when an affected device that is joining a cluster runs out of memory while replicating access control rules. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks.