CVE-2026-20100
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability in the LUA interpreter of the Remote Access SSL VPN feature of Cisco Secure Firewall ASA and FTD Software could allow an authenticated, remote attacker with a valid VPN connection to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
Risk Assessment
The risk to the organization is the potential for a denial of service, which could lead to service outages for VPN users.
Recommendation
It is recommended to update the software to the latest version to mitigate this vulnerability and to monitor traffic to the VPN server for potential attack attempts.
Other vulnerabilities in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software
See all- CVE-2026-20082High
A vulnerability in the handling of connection limits in Cisco Secure Firewall ASA could allow an unauthenticated, remote attacker to incorrectly drop incoming TCP SYN packets. An attacker could exploit this vulnerability to block all incoming TCP connections to the device.
- CVE-2026-20073Medium
A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should be denied through an affected device. The issue is due to improper error handling when a device joining a cluster runs out of memory while replicating access control rules.
- CVE-2025-20127High
A vulnerability in the TLS 1.3 implementation for a specific cipher for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software for Firepower 3100 and 4200 Series devices could allow an authenticated, remote attacker to consume resources associated with incoming TLS 1.3 connections, eventually causing the device to stop accepting any new SSL/TLS or VPN requests. The issue is due to the implementation of the TLS 1.3 Cipher TLS_CHACHA20_POLY1305_SHA256. Sending a large number of TLS 1.3 connections with this cipher can cause a DoS condition where no new incoming encrypted connections are accepted. The device must be reloaded to clear this condition.
Original NVD description (English source)
A vulnerability in the LUA interperter of the Remote Access SSL VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with a valid VPN connection to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This does not affect the management or MUS interfaces. This vulnerability is due to trusting user input without validation in the LUA interprerter. An attacker could exploit this vulnerability by sending crafted HTTP packets to the Remote Access SSL VPN server. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.