CVE-2026-20135
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense (FTD) Software is caused by improper buffer management during TLS 1.3 connection handling. An unauthenticated remote attacker can send a crafted TLS 1.3 packet through a TLS 1.3-enabled listening socket, causing the LINA process to crash and the device to reload unexpectedly (DoS).
Risk Assessment
Successful exploitation causes the edge device to reload, disrupting network and service access for all users behind the firewall. The attack requires no authentication, so the device is exposed to attacks from anywhere with access to the listening TLS port.
Recommendation
Apply the Cisco-provided fix for Cisco Secure Firewall Threat Defense as soon as possible. Until patched, restrict access to TLS 1.3 interfaces from untrusted networks and monitor logs for unexpected LINA process restarts.
Other vulnerabilities in Cisco Secure Firewall Threat Defense
See all- CVE-2026-20064Medium
A vulnerability in Cisco Secure Firewall Threat Defense (FTD) Software allows an authenticated local attacker with a low-privileged account to cause the device to unexpectedly reload, resulting in a DoS condition. This is due to improper validation of user-supplied input.
- CVE-2026-20052Medium
A vulnerability in the memory management handling for the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. This is due to a logic error in memory management during SSL packet inspection. A successful exploit could cause a DoS condition.
- CVE-2026-20017Medium
A vulnerability in the CLI of Cisco Secure FTD Software allows an authenticated local attacker with administrative credentials to execute arbitrary commands on the underlying operating system as root. This is due to insufficient input validation of user-supplied command arguments.
- CVE-2026-20007Medium
A vulnerability in the Snort 2 and Snort 3 deep packet inspection of Cisco Secure Firewall Threat Defense (FTD) Software allows an unauthenticated, remote attacker to bypass configured Snort rules and allow traffic onto the network that should have been dropped. This is due to a logic error in the integration of Snort Engine rules with FTD Software.
- CVE-2026-20006Medium
A vulnerability in the TLS cryptography functionality of the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to unexpectedly restart, resulting in a DoS condition. This is due to improper implementation of the TLS protocol. TLS 1.3 is not affected.
Original NVD description (English source)
A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper buffer management during the TLS 1.3 connection. An attacker could exploit this vulnerability by sending a crafted TLS 1.3 packet to an affected system through a TLS 1.3-enabled listening socket. A successful exploit could allow the attacker to cause the LINA process to crash, which would cause the device to reload. The reload can happen before or after authentication of the connection.Note: TLS 1.3 connections include both data traffic and user-management traffic.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS