CVE-2026-20101
Analyzed Analyzed - Analysis Complete

SAML Message Processing DoS in Cisco Secure Firewall Software

Publication date: 2026-03-04

Last updated on: 2026-08-11

Assigner: Cisco Systems, Inc.

Description
A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition. This vulnerability is due to insufficient error checking when processing SAML messages. An attacker could exploit this vulnerability by sending crafted SAML messages to the SAML service. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-04
Last Modified
2026-08-11
Generated
2026-08-15
AI Q&A
2026-03-04
EPSS Evaluated
2026-08-14
NVD
CVE-2026-20101
EUVD
EUVD-2026-9440

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cisco secure_firewall_threat_defense From 7.7.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-330 The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software. It is caused by insufficient error checking when processing SAML messages.

An unauthenticated, remote attacker can exploit this by sending specially crafted SAML messages to the device's SAML service.

If successful, the exploit causes the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition.

Detection Guidance

I don't know

Impact Analysis

The primary impact of this vulnerability is a denial-of-service (DoS) condition on affected Cisco Secure Firewall ASA and Secure FTD devices.

An attacker can cause the device to reload unexpectedly, which can disrupt network security operations and availability.

This could lead to temporary loss of firewall protection and potential interruption of business-critical network services.

Compliance Impact

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20101. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart