CVE-2026-20073

Analyzed Analyzed - Analysis Complete

Access Control Bypass in Cisco ASA/FTD via Memory Handling Flaw

Publication date: 2026-03-04

Last updated on: 2026-08-11

Assigner: Cisco Systems, Inc.

Description

A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should be denied through an affected device. This vulnerability is due to improper error handling when an affected device that is joining a cluster runs out of memory while replicating access control rules. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-04

Last Modified

2026-08-11

Generated

2026-08-15

AI Q&A

2026-03-04

EPSS Evaluated

2026-08-14

NVD

CVE-2026-20073

EUVD

EUVD-2026-9470

Affected Vendors & Products

Vendor	Product	Version / Range
cisco	secure_firewall_threat_defense	7.7.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software when used in a cluster configuration.

It occurs due to improper error handling when a device joining a cluster runs out of memory while replicating access control lists (ACLs). If the ACL contains many entries, memory exhaustion can cause the device to join the cluster with an incomplete ACL.

As a result, traffic that should be denied by the firewall may be allowed through, enabling an unauthenticated, remote attacker to bypass access controls and reach protected network devices.

Detection Guidance

This vulnerability affects Cisco Secure Firewall ASA and Secure FTD Software when deployed in a cluster configuration. To detect if your device is potentially affected, you can verify if clustering is enabled and check the cluster status and node details.

Use the device CLI command `show cluster info` to display cluster status and node details.

Additionally, Cisco provides a Software Checker tool to help identify vulnerable software versions and the earliest fixed releases.

Impact Analysis

The vulnerability can allow an unauthenticated, remote attacker to bypass firewall access controls by sending traffic that should be blocked through the affected device.

This could lead to unauthorized access to devices within protected networks, potentially exposing sensitive systems or data.

There are no workarounds available; the only mitigation is upgrading to fixed software releases provided by Cisco.

Compliance Impact

I don't know

Mitigation Strategies

There are no workarounds available for this vulnerability. The immediate and recommended mitigation step is to upgrade to the fixed software releases provided by Cisco.

Customers are strongly advised to upgrade affected devices running vulnerable versions of Cisco Secure Firewall ASA or Secure FTD Software in cluster mode to the fixed releases.

If assistance is needed, contacting Cisco Technical Assistance Center (TAC) for upgrade support is recommended.

Hi! I’m here to help you understand CVE-2026-20073. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70