CVE-2026-20082
HighSummary
A vulnerability in the handling of connection limits in Cisco Secure Firewall ASA could allow an unauthenticated, remote attacker to incorrectly drop incoming TCP SYN packets. An attacker could exploit this vulnerability to block all incoming TCP connections to the device.
Risk Assessment
The risk to the organization is the potential for denial of service (DoS) conditions, preventing remote management access and VPN connections, as well as affecting all TCP-based protocols.
Recommendation
It is recommended to update Cisco Secure Firewall ASA software to the latest version to mitigate this vulnerability and to monitor network traffic for potential SYN flood attacks.
Other vulnerabilities in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
See all- CVE-2026-20100High
A vulnerability in the LUA interpreter of the Remote Access SSL VPN feature of Cisco Secure Firewall ASA and FTD Software could allow an authenticated, remote attacker with a valid VPN connection to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
- CVE-2026-20073Medium
A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should be denied through an affected device. The issue is due to improper error handling when a device joining a cluster runs out of memory while replicating access control rules.
- CVE-2025-20127High
A vulnerability in the TLS 1.3 implementation for a specific cipher for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software for Firepower 3100 and 4200 Series devices could allow an authenticated, remote attacker to consume resources associated with incoming TLS 1.3 connections, eventually causing the device to stop accepting any new SSL/TLS or VPN requests. The issue is due to the implementation of the TLS 1.3 Cipher TLS_CHACHA20_POLY1305_SHA256. Sending a large number of TLS 1.3 connections with this cipher can cause a DoS condition where no new incoming encrypted connections are accepted. The device must be reloaded to clear this condition.
Original NVD description (English source)
A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause incoming TCP SYN packets to be dropped incorrectly. This vulnerability is due to improper handling of new, incoming TCP connections that are destined to management or data interfaces when the device is under a TCP SYN flood attack. An attacker could exploit this vulnerability by sending a crafted stream of traffic to an affected device. A successful exploit could allow the attacker to prevent all incoming TCP connections to the device from being established, including remote management access, Remote Access VPN (RAVPN) connections, and all network protocols that are TCP-based. This results in a denial of service (DoS) condition for affected features.