Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software

Name: Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
Brand: Cisco

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

1critical9high15medium0low

updated 2026-10-27

vulnerabilities (73)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-20362US	high8.6OT critical	87.1% (100th)	KEV	no fix	2025-09-25	235 versions
CVE-2025-20333US	—OT critical	71.2% (99th)	KEV	no fix	2025-09-25	206 versions
CVE-2026-20349US	—OT critical	1.01% (63rd)	KEV	no fix	2026-08-11	133 versions
CVE-2023-38545US	critical9.8	78.7% (100th)	Exploit	no fix	2023-10-18	—
CVE-2021-3449US	medium5.9	63.5% (99th)	Exploit	no fix	2021-03-25	—
CVE-2021-1585US	high8.1	20.0% (97th)	Exploit	no fix	2021-07-08	—
CVE-2021-3450US	high7.4	18.3% (97th)	Exploit	no fix	2021-03-25	—
CVE-2019-1687US	high7.5	2.93% (87th)	—	no fix	2019-05-03	—
CVE-2022-28199US	—	2.32% (83rd)	—	no fix	2022-09-01	—
CVE-2018-15398US	medium4.0	1.89% (79th)	—	no fix	2018-10-05	—
CVE-2018-15399US	medium6.8	1.84% (79th)	—	no fix	2018-10-05	—
CVE-2018-0251US	medium6.1	1.83% (79th)	—	no fix	2018-04-19	—
CVE-2018-0242US	medium6.1	1.73% (77th)	—	no fix	2018-04-19	—
CVE-2021-34781US	high7.5	1.40% (72nd)	—	no fix	2021-10-27	—
CVE-2019-1701US	medium4.8	0.87% (59th)	—	no fix	2019-05-03	—
CVE-2026-20099US	—	0.74% (54th)	—	no fix	2026-02-25	135 versions
CVE-2019-1695US	medium6.5	0.71% (53rd)	—	no fix	2019-05-03	—
CVE-2024-20339US	high7.5	0.71% (53rd)	—	no fix	2024-10-23	—
CVE-2024-20358US	medium6.7	0.70% (53rd)	—	no fix	2024-04-24	236 versions
CVE-2024-20340US	medium6.5	0.45% (39th)	—	no fix	2024-10-23	≤ vers:unknown/*
CVE-2026-20018US	—	0.45% (39th)	—	no fix	2026-03-04	≤ vers:unknown/*
CVE-2026-20052US	—	0.44% (38th)	—	no fix	2026-03-04	≤ vers:unknown/*
CVE-2026-20031US	—	0.44% (38th)	—	no fix	2026-03-04	≤ vers:unknown/*
CVE-2020-3334US	high7.4	0.43% (37th)	—	no fix	2020-05-06	—
CVE-2026-20082US	—	0.43% (37th)	—	no fix	2026-03-04	2 versions
CVE-2026-20073US	—	0.40% (35th)	—	no fix	2026-03-04	160 versions
CVE-2026-20009US	—	0.40% (34th)	—	no fix	2026-03-04	83 versions
CVE-2026-20050US	—	0.40% (34th)	—	no fix	2026-03-04	≤ vers:unknown/*
CVE-2026-20006US	—	0.40% (34th)	—	no fix	2026-03-04	≤ vers:unknown/*
CVE-2026-20039US	—	0.37% (31st)	—	no fix	2026-03-04	143 versions
CVE-2026-20101US	—OT elevated	0.37% (30th)	—	no fix	2026-03-04	148 versions
CVE-2026-20103US	—	0.36% (30th)	—	no fix	2026-03-04	98 versions
CVE-2026-20002US	—	0.36% (30th)	—	no fix	2026-03-04	≤ vers:unknown/*
CVE-2026-20086US	—	0.36% (30th)	—	no fix	2026-03-25	≤ vers:unknown/*
CVE-2026-20084US	—	0.36% (30th)	—	no fix	2026-03-25	≤ vers:unknown/*
CVE-2026-20012US	—	0.36% (30th)	—	no fix	2026-03-25	236 versions
CVE-2026-20114US	—	0.35% (29th)	—	no fix	2026-03-25	≤ vers:unknown/*
CVE-2026-20016US	medium6.7	0.35% (28th)	—	no fix	2026-03-04	≤ vers:unknown/*
CVE-2026-20001US	—	0.34% (28th)	—	no fix	2026-03-04	≤ vers:unknown/*
CVE-2026-20106US	—	0.34% (27th)	—	no fix	2026-03-04	148 versions
CVE-2026-20105US	—	0.33% (26th)	—	no fix	2026-03-04	148 versions
CVE-2026-20015US	—	0.32% (25th)	—	no fix	2026-03-04	58 versions
CVE-2026-20013US	—	0.32% (25th)	—	no fix	2026-03-04	150 versions
CVE-2026-20049US	—	0.30% (23rd)	—	no fix	2026-03-04	132 versions
CVE-2026-20014US	—	0.30% (23rd)	—	no fix	2026-03-04	69 versions
CVE-2026-20100US	—	0.30% (22nd)	—	no fix	2026-03-04	148 versions
CVE-2026-20003US	—	0.30% (22nd)	—	no fix	2026-03-04	≤ vers:unknown/*
CVE-2019-1945US	high7.8	0.30% (22nd)	—	no fix	2019-08-07	—
CVE-2026-20125US	—	0.29% (21st)	—	no fix	2026-03-25	≤ vers:unknown/*
CVE-2026-20069US	—	0.29% (21st)	—	no fix	2026-03-04	152 versions

showing 50 of 73

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-401Missing Release of Memory after Effective Lifetime7 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6 CVEs
CWE-20Improper Input Validation5 CVEs
CWE-250Execution with Unnecessary Privileges4 CVEs
CWE-284Improper Access Control4 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')4 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer3 CVEs
CWE-400Uncontrolled Resource Consumption3 CVEs

sources (3)

Which sources assert this record, and when.

NLNCSC-NL (CSAF)50 CVEs
EUEU Vulnerability Database (ENISA)31 CVEs
USCisco PSIRT (CSAF)18 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan