September 2026
CVE-2026-20250: Cisco Secure Firewall ASA and FTD for Firepower 3100 and 4200 Series DTLS Denial of Service Vulnerability
DTLS traffic can reload affected Secure Firewall 3100 and 4200 devices with flow offload enabled. Evaluate CPU and throughput impact before disabling offload temporarily, then install the platform-specific software fix.
CVE-2026-20249: Cisco Secure Firewall ASA and FTD IKEv2 Certificate Authentication Denial of Service Vulnerability
Crafted certificates can crash IKEv2 and reload affected ASA or FTD devices. Verify both IKEv2 enablement and certificate authentication, then install the CVE-specific update; the reported result is disruption, not successful VPN authentication.
CVE-2026-20248: Cisco Secure Firewall ASA and FTD TCP DNS Denial of Service Vulnerability
A crafted DNS-over-TCP reply can reload vulnerable ASA or FTD devices. Assess the answering DNS service and response path, then install fixed software; the attacker must control or alter the device's DNS exchange.
CVE-2026-20247: Cisco ISE Unauthenticated SQL Injection Vulnerability
Unauthenticated SQL injection can modify Cisco ISE database contents. Apply the CVE-specific patch and investigate earlier data changes separately; the reviewed impact does not establish database disclosure or operating-system control.
CVE-2026-20242: Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability
An attacker controlling an allowed External Database Access host can execute root commands on vulnerable FMC software. Check the feature and host list, evaluate temporary disablement, and install the CVE-specific fixed release.
CVE-2026-20237: Cisco ISE hardening: Input Validation Vulnerabilities
Cisco's ISE and ISE-PIC hardening entry covers input-validation and path-handling weaknesses without a specific file-access mechanism. Follow product-specific patch guidance; the body retains conflicting published scores rather than resolving them by assumption.
CVE-2026-20235: Cisco Identity Services Engine Information Disclosure Vulnerability
An ISE administrator can retrieve sensitive information, including credential hashes, through a crafted API request. Apply the CVE-specific patch and scope suspected exposure; disclosed hashes do not establish direct plaintext-password recovery.
CVE-2026-20234: Cisco ISE hardening: Insufficiently Protected Credential Vulnerabilities
Cisco's ISE hardening entry concerns insufficiently protected credentials but identifies no particular account or credential store. Apply the ISE or ISE-PIC patch guidance without assuming a shared default password or inventing a credential-rotation scope.
CVE-2026-20222: Cisco Secure Firewall ASA and FTD EIGRP Denial of Service Vulnerability
An adjacent-network attacker can exhaust memory through crafted EIGRP updates and reload vulnerable ASA or FTD devices. Confirm EIGRP is enabled, then obtain the CVE-specific fixed release; this notice describes availability loss, not code execution.
CVE-2026-20211: Cisco ISE Remote Code Execution Vulnerability
A highly privileged ISE administrator can submit a crafted serialized Java object and progress from operating-system access to root. Obtain the CVE-specific patch and validate node health and new endpoint authentication after maintenance.