CVE-2026-20135: Cisco Secure Firewall Threat Defense Software TLS 1.3 Denial of Service Vulnerability
Tech GuruQuick Answer
CVE-2026-20135 can crash the LINA process and reload a vulnerable Cisco FTD device when an unauthenticated remote attacker sends a crafted packet to a TLS 1.3-enabled listener. Both the listener and TLS-version conditions matter. Cisco describes temporarily restricting TLS to 1.2, subject to compatibility checks; a platform-specific First Fixed software release is still required.
Fix Or Immediate Action
What to do now: Confirm the affected product, release, and configuration. Apply Cisco's documented mitigation as temporary risk reduction. Enter the exact installed product, platform, and release in Cisco Software Checker and upgrade to the returned First Fixed release. The CVE-specific live advisory and Cisco Software Checker result control the First Fixed release; any combined hardening baseline is supplemental only.
Last verified: 2026-09-17 UTC from Cisco's advisory and CSAF record. Recheck both the affected-products and fixed-software sections before a production change.
Context
Scope And Impact In Plain Language
Who should check: Operators of Cisco Secure FTD deployments covered by this TLS 1.3 advisory. The broad ASA/FTD family label in the status table does not expand this FTD-specific scope.
When this applies: An affected FTD release must have an SSL listening socket configured to allow TLS 1.3. Follow both the listener and TLS-version checks in Affected Scope; finding an SSL socket alone does not establish the TLS 1.3 condition.
What could happen: A crafted TLS 1.3 packet may crash the LINA process and reload the FTD device. Cisco says the reload can occur before or after connection authentication, and the exposed listener may carry data or user-management traffic.
Not sure? Find the exact product, platform, and version in the management interface or CLI, then compare them with this CVE's affected-products section in Cisco's live advisory.
Status At A Glance
| Product scope | Cisco Secure Firewall ASA / FTD |
|---|---|
| CVE | CVE-2026-20135 |
| TechGeeks response tier | P1 — urgent |
| Publication | New final Cisco advisory |
| First published | 2026-09-16T16:00:00+00:00 |
| Last updated | 2026-09-16T16:00:00+00:00 |
| Cisco advisory SIR | High |
| CVE-specific Cisco SIR | Not separately stated |
| CVSS base score / severity | 8.6 — High |
| CVSS vector | CVSS v3.1 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
| CISA KEV at last check | No — this is separate from Cisco severity and is not proof of no exploitation. |
| Cisco exploitation statement | The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. |
What Happened
Improper buffer management during a TLS 1.3 connection can cause FTD's LINA process to crash and the device to reload. The crafted packet must reach a TLS 1.3-enabled listening socket, which may serve data or user-management traffic. Cisco says the reload can occur before or after connection authentication. Its temporary TLS 1.2 restriction removes the described TLS 1.3 exposure but does not fix the code; the mitigation section retains the configuration method, vendor-test attribution and operational cautions.
Affected Scope
This vulnerability affects Cisco devices if they are running a vulnerable release of Cisco Secure FTD Software and have an SSL listening socket that is configured to allow TLS 1.3 connections. For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory. Determine Whether a Device Can Process TLS Packets To determine whether a device that is running Cisco Secure FTD Software can process TLS packets, use the show asp table socket | include SSL command and look for an SSL listening socket on any TCP port. The following example shows the output for SSL listening sockets on TCP ports 443 and 8443: ftd# show asp table socket | include SSL SSL 00185038 LISTEN 172.16.0.250:443 0.0.0.0:* SSL 00188638 LISTEN 10.0.0.250:8443 0.0.0.0:* Determine TLS Versions in Software Configuration To determine whether a device that is running Cisco Secure FTD Software is configured for TLS 1.3, use the show running-config all ssl CLI command. The output will show the maximum TLS version configured. If the version found is TLS 1.3, as shown in the following example, the device may be affected by this vulnerability: ftd# show running-config all ssl ssl server-max-version tlsv1.3 Another way to check the TLS 1.3 configuration on Cisco Secure FTD Software is to use the following steps on Cisco Secure Firewall Management Center (FMC) Software: Log in to Cisco Secure FMC Software. From the menu bar, choose Devices > Platform Settings. Add or edit the Platform Settings Policy that is applied to the affected device. From the navigation menu on the left, choose SSL. From the TLS version drop-down menu, see if TLSv1.3 is selected.
Match the exact hardware or virtual platform, installed train, patch level, enabled service, role, and management or data-plane exposure. A Cisco product-family name alone does not establish applicability.
Steps
What To Do Now
- Confirm. Inventory Cisco Secure Firewall ASA / FTD and record platform, exact release, patch level, enabled feature, role, and exposure.
- Preserve. Save UTC context plus off-device authentication, management, firewall, network, endpoint, and SIEM evidence before logs rotate or a disruptive change removes context.
- Scope. Compare each asset with the live Cisco advisory, including configuration prerequisites and exclusions.
- Reduce exposure. Evaluate and apply Cisco's temporary mitigation in the highlighted panel below; it does not replace the permanent fix.
- Remediate. Follow the CVE-specific method and release guidance under Permanent Fix below.
- Validate. Confirm the resulting version, service health, logging, expected access, an expected denial, failover or cluster state, and representative dependent workflows.
- Escalate. If evidence or exposure creates concern, open incident response and Cisco TAC recovery work rather than treating patch completion as proof of trust.
Fixed Releases And Mitigation
Permanent Fix
Cisco method: Use Cisco Software Checker with the exact installed product, platform, and release to obtain the advisory-specific First Fixed release; the combined September hardening baseline is also recorded.
No compact per-CVE fixed-release table is reproduced here because Cisco may use different First Fixed values by CVE and software train. Use this CVE's live advisory table or Cisco Software Checker; do not infer a fixed release from a combined hardening baseline or another Cisco notice.
Workaround Or Temporary Mitigation
Cisco lists no workaround that fixes the flaw, but describes temporarily removing TLS 1.3 by using FMC and a FlexConfig object to set both minimum and maximum TLS versions to TLS 1.2. Follow the vendor's linked FlexConfig guidance. Cisco reports testing this mitigation in its own test environment; TechGeeks has not reproduced that test. Evaluate applicability, effectiveness, and the effect on required connections, network functionality, and performance before deployment. This temporary configuration change does not replace a fixed software release.
Important boundary: A workaround, ACL, exposure reduction, or service restriction can reduce risk while the update is prepared, but it does not patch the vulnerable code, prove every attack path is closed, or erase an earlier compromise.
Investigation And Recovery
Review management authentication, account and privilege changes, API and web requests, configuration changes, crashes or restarts, resource pressure, and relevant external network telemetry for the vulnerable period. Preserve original evidence and follow Cisco TAC or incident-response guidance for containment, credential rotation, trusted rebuild, or service restoration when findings warrant it.
Notes
Exploitation Evidence
Cisco's exact status at the last check: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
This CVE was not present in the TechGeeks CISA KEV snapshot at the last check. Cisco's 'not aware' statement and absence from KEV are time-bounded evidence, not claims that exploitation is impossible or has never happened. Severity and exploitation status remain separate signals.
Validation And Boundaries
This notice is documentation-backed. TechGeeks did not reproduce the exploit or independently test every fixed build. It does not prove that all members of the product family are affected, that the activity is widespread, that a clean indicator search excludes compromise, or that an update restored trust. Cisco's live advisory controls affected and fixed release information.
Related TechGeeks Resources
- TechGeeks Security Notice Center
- All Security Notices
- What to Do When a Device Hits CISA KEV
- Router CVE Exposure, Version, and Mitigation Checklist
- IoT Firmware Update and End-of-Support Checklist
- Live Protect and Runtime Vulnerability Shielding
References
Wrap-Up
Record whether CVE-2026-20135 applies. If it does, assign an owner and deadline appropriate to the High Cisco advisory SIR, preserve the evidence, complete Cisco's remediation, and document the validated result.
Correction policy: A material Cisco revision to scope, severity, exploitation status, workarounds, fixed software, or recovery guidance triggers an update and a new verification date.
