CVE-2026-20332: Cisco ASA, FTD, and FMC hardening: Improper Access Control Vulnerabilities
Tech GuruQuick Answer
CVE-2026-20332 covers access-control weaknesses in Cisco's ASA, FTD, and FMC hardening release. Check the installed release and ASA hotfix against the live fix table; Cisco provides no workaround. Keep the score-source difference in view: the advisory Details table shows 9.0, while Cisco's checked CSAF record shows 9.9. Related exploited FMC vulnerabilities are identified separately; that context does not establish direct exploitation of every issue in this group.
Fix Or Immediate Action
What to do now: Match your ASA, FTD, or FMC release to Cisco's fixed-software table, including the affected ASA hotfixes. Cisco provides no workaround; use supported exposure controls while preparing the update.
Verification scope: Cisco HTML and CSAF v1.1.0 checked on 2026-10-02, including the September 18 ASA hotfix revision. This CVE is absent from KEV catalog 2026.10.02; absence does not establish non-exploitation. The original September 17 snapshot remains historical. Recheck current fixes before deployment.
Scope And Impact In Plain Language
Who should check: Anyone who manages Cisco Secure Firewall ASA / FTD / FMC.
When this applies: Cisco lists Secure Firewall ASA Software, Secure FTD Software, and Secure FMC Software as affected on vulnerable releases, regardless of device configuration. Check the installed train and hotfix against the fixed-software table.
What could happen: An attacker may be able to bypass a security rule and reach data, systems, or administrative functions that should be blocked.
Not sure? Find the exact product, platform, and version in the management interface or CLI, then compare them with this CVE's affected-products section in Cisco's live advisory.
Status At A Glance
| Product scope | Cisco Secure Firewall ASA / FTD / FMC |
|---|---|
| CVE | CVE-2026-20332 |
| TechGeeks response tier | P1 — urgent |
| Publication | Cisco final advisory |
| First published | 2026-09-16T16:00:00+00:00 |
| Last updated | 2026-09-18 15:50 GMT (Cisco advisory version 1.1) |
| Cisco advisory SIR | Critical |
| CVE-specific Cisco SIR | Not separately stated |
| CVSS base score / severity | 9.9 (Critical), checked Cisco CSAF; Cisco Details table: 9.0. Both sources checked October 2; score difference unresolved. |
| CVSS vector | CVSS v3.1 — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| CISA KEV at last check | No — this is separate from Cisco severity and is not proof of no exploitation. |
| Cisco exploitation statement | Except as otherwise noted previously, the Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory. |
What Happened
Cisco groups access-control weaknesses under CVE-2026-20332 and CWE-284, covering authorization, authentication, privileges, and bypasses. Its Details table shows 9.0, unlike the checked CSAF score of 9.9. The row's footnote points to separately identified exploited FMC static-credential and authentication-bypass vulnerabilities; it is not a report that every issue in this group was exploited.
Record the hardware or virtual platform, software train, patch or hotfix, role, and management or data-plane exposure. Configuration does not exclude a vulnerable release, but these details are needed to plan the upgrade and its validation.
What To Do Now
- Confirm. Inventory Cisco Secure Firewall ASA / FTD / FMC and record platform, exact release, patch level, enabled feature, role, and exposure.
- Preserve. Save logs with UTC timestamps, including off-device authentication, management, firewall, network, endpoint, and SIEM records, before rotation or a disruptive change removes evidence.
- Scope. Compare each asset and any installed ASA hotfix with the live Cisco advisory. Cisco lists vulnerable releases as affected regardless of configuration.
- Reduce exposure. Cisco documents no workaround for this CVE. Use only supported exposure controls while preparing the permanent fix.
- Remediate. Install the advisory-listed fixed release for the software train. An ASA hotfix with a numerically higher suffix can still be listed as affected; check the hotfix column explicitly.
- Validate. Confirm the resulting version, service health, logging, expected access, an expected denial, failover or cluster state, and representative dependent workflows.
- Escalate. If evidence or exposure creates concern, involve incident response and Cisco Technical Assistance Center (TAC). Patch completion is not proof that the system is trustworthy.
Fixed Releases And Mitigation
Permanent Fix
Fixed-release selection: Cisco's September 18 revision explicitly lists affected ASA hotfixes. Systems on those hotfixes must move to the corresponding first-fixed release even where its numeric suffix is lower.
| Software family | Installed train | First Fixed / migration guidance | Affected ASA hotfix |
|---|---|---|---|
| ASA | 9.16 and earlier | 9.16.4.103 | N/A |
| ASA | 9.18 | 9.18.4.94 | 9.18.4.135 |
| ASA | 9.20 | 9.20.4.49 | 9.20.4.235 |
| ASA | 9.22 | 9.22.3.26 | 9.22.3.191 |
| ASA | 9.23 | 9.23.1.47 | 9.23.1.195; 9.23.1.211 |
| ASA | 9.24 | 9.24.1.26 | 9.24.1.155; 9.24.1.221 |
| FTD and FMC | 7.0 and earlier | 7.0.10 | — |
| FTD and FMC | 7.2 | 7.2.12 | — |
| FTD and FMC | 7.4 | 7.4.8 | — |
| FTD and FMC | 7.6 | 7.6.6 | — |
| FTD and FMC | 7.7 | 7.7.13 | — |
| FTD and FMC | 10.0 | 10.0.2 | — |
| FTD and FMC | 10.1 | 10.1.0 | — |
Table boundary: These are Cisco's first-fixed releases for this hardening advisory, not a guarantee that a build resolves every other advisory affecting the device.
The table reflects Cisco's September 18 revision, checked on October 2. Confirm the release and hotfix in the live advisory before deployment. The Cisco Software Checker supports additional checks; this advisory supplies the affected and fixed releases for this decision.
Workaround Or Temporary Mitigation
No vendor workaround is documented for CVE-2026-20332. Use supported exposure controls only as temporary risk reduction while preparing the permanent software fix.
Important boundary: A workaround, ACL, exposure reduction, or service restriction can reduce risk while the update is prepared, but it does not patch the vulnerable code, prove every attack path is closed, or erase an earlier compromise.
Investigation And Recovery
Review management authentication, account and privilege changes, API and web requests, configuration changes, crashes or restarts, resource pressure, and relevant external network telemetry for the vulnerable period. Preserve original evidence and follow Cisco TAC or incident-response guidance for containment, credential rotation, trusted rebuild, or service restoration when findings warrant it.
Exploitation Evidence
Cisco's exact status at the last check: Except as otherwise noted previously, the Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.
This CVE was not present in the TechGeeks CISA KEV snapshot at the last check. Cisco's 'not aware' statement and absence from KEV are time-bounded evidence, not claims that exploitation is impossible or has never happened. Severity and exploitation status remain separate signals.
Cisco Score Source Difference
The advisory Details table shows 9.0, while Cisco's structured CSAF record shows 9.9 and the vector reproduced here. Both sources were checked on October 2; the discrepancy remains unresolved. Cisco's Critical advisory Security Impact Rating (SIR) is a separate vendor rating, not a reconciliation of these CVSS values.
Validation And Boundaries
This notice is documentation-backed. TechGeeks did not reproduce the exploit or independently test every fixed build. It does not prove that all members of the product family are affected, that the activity is widespread, that a clean indicator search excludes compromise, or that an update restored trust. Cisco's live advisory controls affected and fixed release information.
Related TechGeeks Resources
- TechGeeks Security Notice Center
- All Security Notices
- What to Do When a Device Hits CISA KEV
- Router CVE Exposure, Version, and Mitigation Checklist
- IoT Firmware Update and End-of-Support Checklist
- Live Protect and Runtime Vulnerability Shielding
References
Wrap-Up
Record whether CVE-2026-20332 applies. If it does, assign an owner and deadline appropriate to the Critical Cisco advisory SIR, preserve the evidence, complete Cisco's remediation, and document the validated result.
Correction policy: A material Cisco revision to scope, severity, exploitation status, workarounds, fixed software, or recovery guidance triggers an update and a new verification date.
