Firewalls & VPN
CVE-2026-20290: Cisco Secure Firewall Threat Defense Software Snort 2 SSL/TLS Denial of Service Vulnerability
Crafted SSL setup requests can restart the Snort 2 detection engine. Check standalone Snort and the engine actually running on FTD, then follow their respective update paths; a full firewall reload is not established here.
CVE-2026-20295: Cisco Secure FMC Software and Secure FTD Software sftunnel Memory Exhaustion DoS Vulnerability
Crafted frames during sftunnel TLS setup can exhaust memory on vulnerable FMC and FTD devices. Inventory both ends of the management connection, preserve resource-pressure evidence, and install each platform's CVE-specific fixed release.
CVE-2026-20323: Cisco Secure FMC Software and Secure FTD Software sftunnel Unauthorized Authentication Bypass Vulnerability
An adjacent-network attacker can impersonate an sftunnel peer and obtain root-equivalent manager access while the legitimate tunnel is down or disrupted. Update FMC and FTD, preserving peer-registration and interruption evidence for separate investigation.
CVE-2026-20324: Cisco Secure Firewall Management Center sftunnel Root Arbitrary Code Execution Vulnerability
With valid credentials and a registered or hijacked sftunnel connection, an attacker can write a file that executes as root on FMC. Check peers and tunnel state, preserve evidence, and install the specific fix.
CVE-2026-20135: Cisco Secure Firewall Threat Defense Software TLS 1.3 Denial of Service Vulnerability
A crafted packet can crash LINA and reload vulnerable FTD devices with TLS 1.3-enabled listeners. Check both conditions, evaluate Cisco's temporary TLS restriction for compatibility, and install the platform-specific fixed software.
CVE-2026-20154: Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software Logging Denial of Service
SYN-packet floods can overload ASA and FTD processing of syslog message 419002. Check logging configuration, evaluate Cisco's message-specific rate limit, and install fixed software; do not disable all security logging as a substitute.
CVE-2026-20222: Cisco Secure Firewall ASA and FTD EIGRP Denial of Service Vulnerability
An adjacent-network attacker can exhaust memory through crafted EIGRP updates and reload vulnerable ASA or FTD devices. Confirm EIGRP is enabled, then obtain the CVE-specific fixed release; this notice describes availability loss, not code execution.
CVE-2024-20260: Cisco ASA and FTD SSL VPN denial-of-service scope expansion
SSL/TLS connection floods can exhaust memory on affected hardware or virtual ASA and FTD appliances. Check SSL VPN or management HTTP configuration and obtain the CVE-specific fixed release; reloading restores service, not the software fix.
CVE-2026-20120: Cisco FTD ACL bypass vulnerability
ASA and FTD access lists using Object Group Search can allow traffic that should be blocked. Check both release and configuration, then obtain this CVE's First Fixed release through Cisco Software Checker.
CVE-2026-20121: Cisco FTD Bypass Access List
Object Group Search can expose vulnerable ASA and FTD access lists to unauthorized traffic. Match configuration and release using CVE-2026-20121; the paired advisory does not establish a distinct mechanism for each listed CVE.