CVE-2026-20249: Cisco Secure Firewall ASA and FTD IKEv2 Certificate Authentication Denial of Service Vulnerability

Quick Answer

Cisco published a High-rated advisory that includes CVE-2026-20249, affecting Cisco Secure Firewall ASA / FTD under the live advisory's conditions. Cisco does not separately state a CVE-specific Security Impact Rating (SIR); Common Vulnerability Scoring System (CVSS) base 8.6 (High). Confirm the exact platform, release, feature, and exposure; preserve relevant evidence; then follow Cisco's CVE-specific First Fixed guidance. Cisco reported no public announcement or malicious use for this CVE at the last check. That status and absence from CISA KEV are time-bounded and do not prove exploitation has never occurred.

Last verified: 2026-09-17 UTC from Cisco's advisory and CSAF record. Recheck both the affected-products and fixed-software sections before a production change.

Context

Status At A Glance

Product scope	Cisco Secure Firewall ASA / FTD
CVE	CVE-2026-20249
TechGeeks response tier	P1 — urgent
Publication	New final Cisco advisory
First published	2026-09-16T16:00:00+00:00
Last updated	2026-09-16T16:00:00+00:00
Cisco advisory SIR	High
CVE-specific Cisco SIR	Not separately stated
CVSS base score / severity	8.6 — High
CVSS vector	CVSS v3.1 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CISA KEV at last check	No — this is separate from Cisco severity and is not proof of no exploitation.
Cisco exploitation statement	The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

What Happened

A vulnerability in the certification authentication feature of Internet Key Exchange version 2 (IKEv2) for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly. This vulnerability is due to a logic error during the certificate authentication phase of the IKEv2 connection setup. An attacker could exploit this vulnerability by attempting to establish an IKEv2 VPN connection with a crafted certificate. A successful exploit could allow the attacker to cause the IKEv2 process to crash, causing a denial of service (DoS) condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of September 16, 2026, Security Advisories. In addition, for further documentation of improvements and fixes in Cisco Secure Firewall products, see Cisco Secure Firewall Adaptive Security Appliance Software, Secure Firewall Threat Defense Software, and Secure Firewall Management Center Software Hardening Release: September 2026.

Affected Scope

This vulnerability affects Cisco Secure Firewall ASA Software and Secure FTD Software if they have the IKEv2 VPN feature enabled with certificate authentication. For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory. Determine the Software Configuration To determine whether IKEv2 is enabled on Cisco Secure Firewall ASA Software or Secure FTD Software, use the show running-config crypto ikev2 | include enable CLI command. If that command returns output, IKEv2 is enabled on at least one interface. The following example shows the output on a device that has IKEv2 enabled on the outside interface: firewall# show running-config crypto ikev2 | include enable crypto ikev2 enable outside client-services port 443 If the command returns empty output, the device is not affected by this vulnerability. To determine whether IKEv2 is configured for certificate authentication on Cisco Secure Firewall ASA Software or Secure FTD Software, use the show running-config crypto ikev2 | include trust CLI command, as shown in the following example: firewall# show running-config crypto ikev2 | include trust crypto ikev2 remote-access trustpoint VPN-Cert If the command returns empty output, the device is not affected by this vulnerability. If IKEv2 is enabled and a trustpoint certificate is configured, the device is affected by this vulnerability.

Match the exact hardware or virtual platform, installed train, patch level, enabled service, role, and management or data-plane exposure. A Cisco product-family name alone does not establish applicability.

Steps

What To Do Now

1. Confirm. Inventory Cisco Secure Firewall ASA / FTD and record platform, exact release, patch level, enabled feature, role, and exposure.
2. Preserve. Save UTC context plus off-device authentication, management, firewall, network, endpoint, and SIEM evidence before logs rotate or a disruptive change removes context.
3. Scope. Compare each asset with the live Cisco advisory, including configuration prerequisites and exclusions.
4. Reduce exposure. Cisco documents no workaround for this CVE. Use only supported exposure controls while preparing the permanent fix.
5. Remediate. Confirm the affected product, release, and configuration. Cisco provides no workaround; reduce exposure where operationally feasible. Enter the exact installed product, platform, and release in Cisco Software Checker and upgrade to the returned First Fixed release. The CVE-specific live advisory and Cisco Software Checker result control the First Fixed release; any combined hardening baseline is supplemental only.
6. Validate. Confirm the resulting version, service health, logging, expected access, an expected denial, failover or cluster state, and representative dependent workflows.
7. Escalate. If evidence or exposure creates concern, open incident response and Cisco TAC recovery work rather than treating patch completion as proof of trust.

Fixed Releases And Mitigation

Investigation And Recovery

Review management authentication, account and privilege changes, API and web requests, configuration changes, crashes or restarts, resource pressure, and relevant external network telemetry for the vulnerable period. Preserve original evidence and follow Cisco TAC or incident-response guidance for containment, credential rotation, trusted rebuild, or service restoration when findings warrant it.

Notes

Exploitation Evidence

Cisco's exact status at the last check: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

This CVE was not present in the TechGeeks CISA KEV snapshot at the last check. Cisco's 'not aware' statement and absence from KEV are time-bounded evidence, not claims that exploitation is impossible or has never happened. Severity and exploitation status remain separate signals.

Validation And Boundaries

This notice is documentation-backed. TechGeeks did not reproduce the exploit or independently test every fixed build. It does not prove that all members of the product family are affected, that the activity is widespread, that a clean indicator search excludes compromise, or that an update restored trust. Cisco's live advisory controls affected and fixed release information.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices
• What to Do When a Device Hits CISA KEV
• Router CVE Exposure, Version, and Mitigation Checklist
• IoT Firmware Update and End-of-Support Checklist
• Live Protect and Runtime Vulnerability Shielding

References

• Cisco security advisory
• Cisco CSAF record
• Cisco September 16 publication notice
• NVD identifier record

Wrap-Up

Record whether CVE-2026-20249 applies. If it does, assign an owner and deadline appropriate to the High Cisco advisory SIR, preserve the evidence, complete Cisco's remediation, and document the validated result.

Correction policy: A material Cisco revision to scope, severity, exploitation status, workarounds, fixed software, or recovery guidance triggers an update and a new verification date.