CVE-2026-20106
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability in the Remote Access SSL VPN, HTTP management, and MUS functionality of Cisco Secure Firewall ASA and FTD Software could allow an unauthenticated, remote attacker to exhaust device memory, resulting in a denial of service (DoS) condition requiring a manual reboot. This is due to trusting user input without validation. An attacker could exploit this by sending crafted packets to the Remote Access SSL VPN server.
Risk Assessment
An attack could cause the device to stop responding, leading to disruption of VPN and management services, impacting business continuity. Manual reboot is required, extending downtime.
Recommendation
Apply updates provided by Cisco for ASA and FTD software. Restrict access to the Remote Access SSL VPN server to trusted sources and monitor for unusual traffic.
Other vulnerabilities in Cisco Secure Firewall ASA/FTD Software
See all- CVE-2026-20024Medium
A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA and FTD software allows an authenticated, adjacent attacker to cause an unexpected device reload, resulting in a DoS condition. The issue is due to heap corruption when parsing OSPF packets.
- CVE-2026-20015Medium
A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA and FTD Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device, potentially impacting availability of services to other devices in the network. This is due to a memory leak when parsing IKEv2 packets. An attacker could send crafted IKEv2 packets, exhausting resources and eventually requiring manual reload.
- CVE-2026-20013Medium
A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA and FTD Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device, potentially impacting availability of services to other devices in the network. This is due to memory exhaustion caused by not freeing memory during IKEv2 packet processing. An attacker could send crafted IKEv2 packets, exhausting resources and eventually requiring manual reload.
Original NVD description (English source)
A vulnerability in the Remote Access SSL VPN, HTTP management and MUS functionality, of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust device memory resulting in a denial of service (DoS) condition requiring a manual reboot. This vulnerability is due to trusting user input without validation. An attacker could exploit this vulnerability by sending crafted packets to the Remote Access SSL VPN server. A successful exploit could allow the attacker to cause the device to stop responding, resulting in a DoS condition.