CVE-2026-20049

highpriority · track · 0EPSS 0.003 · 22 %ileDEEUNLUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.30% (22nd) EPSS

CVSS 7.7 · high

Is it mine?

223 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · ncsc_nl

EPSS · scored 2026-10-21

A vulnerability in the processing of Galois/Counter Mode (GCM)-encrypted Internet Key Exchange version 2 (IKEv2) IPsec traffic of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to the allocation of an insufficiently sized block of memory. An attacker could exploit this vulnerability by sending crafted GCM-encrypted IPsec traffic to an affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device, resulting in a DoS condition. To exploit this vulnerability, the attacker must have valid credentials to establish a VPN connection with the affected device.

cvss

Technical severity, 0–10. One row per scoring source.

7.7

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.7highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.7highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:Hsecondary · psirt@cisco.com USexploitability 3.1 · impact 4

v3.17.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.7highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-131USCWE-131US

affected products (223)

Products and version ranges known to be affected.

Cisco ASA (Adaptive Security Appliance)all versionscert_bundDEcpe:/h:cisco:adaptive_security_appliance:-
Cisco Secure Firewall Threat Defenseall versionscert_bundDEcpe:/a:cisco:secure_firewall_threat_defense:-
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software≤ 9.20.3.4enisa_euvdEU
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software≤ 9.17.1.7enisa_euvdEU
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software≤ 9.16.4.9enisa_euvdEU
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software≤ 9.18.4.29enisa_euvdEU
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software≤ 9.16.4.57enisa_euvdEU
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software≤ 9.18.3.55enisa_euvdEU
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software≤ 9.16.3.15enisa_euvdEU
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software≤ 9.18.2.5enisa_euvdEU
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software≤ 9.12.4.48enisa_euvdEU
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software≤ 9.16.2.14enisa_euvdEU
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software≤ 9.20.3.7enisa_euvdEU
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software≤ 9.12.4.40enisa_euvdEU
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software≤ 9.19.1.22enisa_euvdEU
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software≤ 9.17.1.13enisa_euvdEU
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software≤ 9.22.1.2enisa_euvdEU
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software≤ 9.12.4.47enisa_euvdEU
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software≤ 9.20.2.22enisa_euvdEU
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software≤ 9.18.3.56enisa_euvdEU

showing 20 of 223

advisories (2)

Vendor and ecosystem advisories describing this.

NCSC-2026-0077Kwetsbaarheden verholpen in Cisco Secure Firewall systemenNL2026-03-05csaf · ncsc_nlNL
Cisco heeft meerdere kwetsbaarheden verholpen in Cisco Secure Firewall (inclusief ASA en FTD software).
WID-SEC-W-2026-0603Cisco ASA (Adaptive Security Appliance) und Secure Firewall Threat Defense: Mehrere SchwachstellenDeutsch2026-03-04csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Cisco ASA (Adaptive Security Appliance) und Cisco Secure Firewall Threat Defense ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, um beliebigen Code auszuführen, und um einen Cross-Site Scripting Angriff durchzuführen.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund ncsc_nl NVD CVE.org MITRE

published 2026-03-04modified 2026-08-11

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan