CVE-2026-20073 Details
Description
A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should be denied through an affected device. This vulnerability is due to improper error handling when an affected device that is joining a cluster runs out of memory while replicating access control rules. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks.
A vulnerability exists in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. It allows an unauthenticated, remote attacker to send traffic that should be denied through an affected device. This issue arises from improper error handling when a device joining a cluster runs out of memory while replicating access control rules. Exploitation of this vulnerability could enable an attacker to bypass access controls and access devices in protected networks.
Cisco has released software updates to address this vulnerability. Instructions for upgrading Cisco Secure FTD devices can be found in the Cisco Secure FMC upgrade guide.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-aclbypass-dos-CVxVRSvQ | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cisco adaptive security appliance software | 9.12.1 9.12.1.2 9.12.1.3 9.12.2 9.12.2.1 9.12.2.4 9.12.2.5 9.12.2.9 9.12.3 9.12.3.2 9.12.3.7 9.12.3.9 9.12.3.12 9.12.4 9.12.4.2 9.12.4.4 9.12.4.7 9.12.4.8 9.12.4.10 9.12.4.13 9.12.4.18 9.12.4.24 9.12.4.26 9.12.4.29 9.12.4.30 9.12.4.35 9.12.4.37 9.12.4.38 9.12.4.39 9.12.4.40 9.12.4.41 9.12.4.47 9.12.4.48 9.12.4.50 9.12.4.52 9.12.4.54 9.12.4.55 9.12.4.56 9.12.4.58 9.12.4.62 9.12.4.65 9.12.4.67 9.16.1 9.16.1.28 9.16.2 9.16.2.3 9.16.2.7 9.16.2.11 9.16.2.13 9.16.2.14 9.16.3 9.16.3.3 9.16.3.14 9.16.3.15 9.16.3.19 9.16.3.23 9.16.4 9.16.4.9 9.16.4.14 9.16.4.19 9.16.4.27 9.16.4.38 9.16.4.39 9.16.4.42 9.16.4.48 9.16.4.55 9.16.4.57 9.16.4.61 9.16.4.62 9.16.4.67 9.16.4.70 9.16.4.71 9.16.4.76 9.16.4.82 9.16.4.84 9.17.1 9.17.1.7 9.17.1.9 9.17.1.10 9.17.1.11 9.17.1.13 9.17.1.15 9.17.1.20 9.17.1.30 9.17.1.33 9.17.1.39 9.17.1.45 9.17.1.46 9.18.1 9.18.1.3 9.18.2 9.18.2.5 9.18.2.7 9.18.2.8 9.18.3 9.18.3.39 9.18.3.46 9.18.3.53 9.18.3.55 9.18.3.56 9.18.4 9.18.4.5 9.18.4.8 9.18.4.22 9.18.4.24 9.18.4.29 9.18.4.34 9.18.4.40 9.18.4.47 9.18.4.50 9.18.4.52 9.18.4.53 9.18.4.57 9.18.4.66 9.18.4.67 9.19.1 9.19.1.5 9.19.1.9 9.19.1.12 9.19.1.18 9.19.1.22 9.19.1.24 9.19.1.27 9.19.1.28 9.19.1.31 9.19.1.37 9.19.1.38 9.19.1.42 9.20.1 9.20.1.5 9.20.2 9.20.2.10 9.20.2.21 9.20.2.22 9.20.3 9.20.3.4 9.20.3.7 9.20.3.9 9.20.3.10 9.20.3.13 9.20.3.16 9.20.3.20 9.20.4 9.20.4.7 9.20.4.10 9.22.1.1 9.22.1.2 9.22.1.3 9.22.1.6 9.22.2 9.22.2.4 9.22.2.9 9.22.2.13 9.23.1 9.23.1.3 9.23.1.7 9.23.1.13 9.23.1.19 |
CPE
Remediation
| |
| cisco secure firewall threat defense | 6.4.0 6.4.0.1 6.4.0.2 6.4.0.3 6.4.0.4 6.4.0.5 6.4.0.6 6.4.0.7 6.4.0.8 6.4.0.9 6.4.0.10 6.4.0.11 6.4.0.12 6.4.0.13 6.4.0.14 6.4.0.15 6.4.0.16 6.4.0.17 6.4.0.18 7.0.0 7.0.0.1 7.0.1 7.0.1.1 7.0.2 7.0.2.1 7.0.3 7.0.4 7.0.5 7.0.6 7.0.6.1 7.0.6.2 7.0.6.3 7.0.7 7.0.8 7.0.8.1 7.1.0 7.1.0.1 7.1.0.2 7.1.0.3 7.2.0 7.2.0.1 7.2.1 7.2.2 7.2.3 7.2.4 7.2.4.1 7.2.5 7.2.5.1 7.2.5.2 7.2.6 7.2.7 7.2.8 7.2.8.1 7.2.9 7.2.10 7.3.0 7.3.1 7.3.1.1 7.3.1.2 7.4.0 7.4.1 7.4.1.1 7.4.2 7.4.2.1 7.4.2.2 7.4.2.3 7.4.2.4 7.6.0 7.6.1 7.6.2 7.6.2.1 7.7.0 7.7.10 7.7.10.1 |
CPE
Remediation
| |
Change History
78 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 11, 2026 | CPE Deprecation Remap | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | Initial Analysis | [email protected] |
| Mar 4, 2026 | New CVE Received | [email protected] |