Cisco

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Cisco product.

RSS Feeds for Cisco security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Cisco products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Cisco Sorted by Most Security Vulnerabilities since 2018

Cisco IOS XE311 vulnerabilities
Newer version of Cisco IOS Operating System built on linux.

Cisco Internetwork Operating System (IOS)209 vulnerabilities
Cisco Internetwork Operating System (IOS) is a family of network operating systems used on many Cisco Systems routers and current Cisco network switches.

Cisco Adaptive Security Appliance Software206 vulnerabilities

Cisco Firepower Threat Defense194 vulnerabilities

Cisco Secure Firewall Management Center182 vulnerabilities

Cisco Identity Services Engine142 vulnerabilities

Cisco Firepower Management Center141 vulnerabilities

Cisco Small Business Rv Series Router Firmware137 vulnerabilities

Cisco Adaptive Security Appliance128 vulnerabilities

Cisco Catalyst Sd Wan Manager85 vulnerabilities

Cisco Nx Os84 vulnerabilities

Cisco Unified Communications Manager83 vulnerabilities

Cisco Sd Wan Vmanage77 vulnerabilities

Cisco Ios Xr64 vulnerabilities

Cisco Data Center Network Manager63 vulnerabilities

Cisco Webex Meetings57 vulnerabilities

Cisco Sd Wan56 vulnerabilities

Cisco Prime Infrastructure53 vulnerabilities

Cisco Firepower Threat Defense Software48 vulnerabilities

Cisco Identity Services Engine Software46 vulnerabilities

Cisco Unified Contact Center Express45 vulnerabilities

Cisco Unified Computing System37 vulnerabilities

Cisco Evolved Programmable Network Manager37 vulnerabilities

Cisco Unified Communications Manager Im Presence Service36 vulnerabilities

Cisco Wireless Lan Controller Software33 vulnerabilities

Cisco Telepresence Video Communication Server33 vulnerabilities

Cisco Unity Connection33 vulnerabilities

Cisco Email Security Appliance33 vulnerabilities

Cisco Anyconnect Secure Mobility Client29 vulnerabilities

Cisco Telepresence Collaboration Endpoint28 vulnerabilities

Cisco Dna Center27 vulnerabilities

Cisco Application Policy Infrastructure Controller26 vulnerabilities

Cisco Asyncos25 vulnerabilities

Cisco Roomos25 vulnerabilities

Cisco Web Security Appliance25 vulnerabilities

Cisco Enterprise Nfv Infrastructure Software25 vulnerabilities

Cisco Catalyst Center24 vulnerabilities

Cisco Jabber23 vulnerabilities

Cisco Nexus Dashboard22 vulnerabilities

Cisco Sd Wan Manager19 vulnerabilities

Cisco Common Services Platform Collector19 vulnerabilities

Cisco Aironet Access Point Software18 vulnerabilities

Cisco Unified Intelligence Center18 vulnerabilities

Cisco Iot Field Network Director16 vulnerabilities

Cisco Finesse16 vulnerabilities

Cisco Prime Collaboration Provisioning16 vulnerabilities

Cisco Expressway16 vulnerabilities

Cisco Smart Software Manager On Prem16 vulnerabilities

Cisco Webex Business Suite15 vulnerabilities

Cisco Webex Teams15 vulnerabilities

Cisco Cyber Vision15 vulnerabilities

Cisco Integrated Management Controller14 vulnerabilities

Cisco Enterprise Chat And Email14 vulnerabilities

Cisco Hyperflex Hx Data Platform14 vulnerabilities

Cisco Secure Endpoint13 vulnerabilities

Cisco Clamav13 vulnerabilities

Cisco Nexus Dashboard Fabric Controller13 vulnerabilities

Cisco Industrial Network Director12 vulnerabilities

Cisco Network Services Orchestrator11 vulnerabilities

Cisco Unified Computing System Director11 vulnerabilities

Cisco Unified Contact Center Enterprise11 vulnerabilities

Cisco Ios Xe Sd Wan10 vulnerabilities

Cisco Packaged Contact Center Enterprise10 vulnerabilities

Cisco Emergency Responder10 vulnerabilities

Cisco Content Security Management Appliance10 vulnerabilities

Cisco Secure Client9 vulnerabilities

Cisco Broadworks9 vulnerabilities

Cisco Telepresence Management Suite9 vulnerabilities

Cisco Secure Network Analytics8 vulnerabilities

Cisco Secure Email And Web Manager8 vulnerabilities

Cisco Prime Collaboration Assurance8 vulnerabilities

Cisco Secure Endpoint Private Cloud8 vulnerabilities

Cisco Identity Services Engine Passive Identity Connector7 vulnerabilities

Cisco Intersight Virtual Appliance7 vulnerabilities

Recent Cisco Security Advisories

Advisory	Title	Published
2026-03-11	Cisco IOS XR Software CLI Privilege Escalation Vulnerabilities	March 11, 2026
2026-03-11	Cisco IOS XR Egress Packet Network Interface Aligner Interrupt Denial of Service Vulnerability	March 11, 2026
2026-03-11	Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities	March 11, 2026
2026-03-11	Cisco IOS XR Software Multi-Instance Intermediate System-to-Intermediate System Denial of Service Vulnerability	March 11, 2026
2026-03-05	Multiple Cisco Products Snort 3 Visual Basic for Applications Denial of Service Vulnerabilities	March 5, 2026
2026-03-05	Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Access Control List Bypass Vulnerability	March 5, 2026
2026-03-05	Cisco Secure Firewall Adaptive Security Appliance Software Multiple Context Mode SCP Unauthorized File Access Vulnerability	March 5, 2026
2026-03-05	Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IPsec Denial of Service Vulnerability	March 5, 2026
2026-03-05	Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software Path Traversal Vulnerability	March 5, 2026
2026-03-05	Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Server Denial of Service Vulnerability	March 5, 2026

Known Exploited Cisco Vulnerabilities

The following Cisco vulnerabilities have recently been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Cisco SD-WAN Path Traversal Vulnerability	Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. CVE-2022-20775 Exploit Probability: 0.5%	February 25, 2026
Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability	Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affec CVE-2026-20127 Exploit Probability: 2.6%	February 25, 2026
Cisco Unified Communications Products Code Injection Vulnerability	Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. CVE-2026-20045 Exploit Probability: 1.0%	January 21, 2026
Cisco Multiple Products Improper Input Validation Vulnerability	Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance. CVE-2025-20393 Exploit Probability: 6.3%	December 17, 2025
Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability	Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system. CVE-2025-20352 Exploit Probability: 2.0%	September 29, 2025
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Mis	Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333. CVE-2025-20362 Exploit Probability: 37.1%	September 25, 2025
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buf	Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362. CVE-2025-20333 Exploit Probability: 18.8%	September 25, 2025
Cisco Identity Services Engine Injection Vulnerability	Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. CVE-2025-20337 Exploit Probability: 0.7%	July 28, 2025
Cisco Identity Services Engine Injection Vulnerability	Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. CVE-2025-20281 Exploit Probability: 30.4%	July 28, 2025
Cisco Smart Licensing Utility Static Credential Vulnerability	Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials. CVE-2024-20439 Exploit Probability: 86.3%	March 31, 2025
Cisco Small Business RV Series Routers Command Injection Vulnerability	Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data. CVE-2023-20118 Exploit Probability: 3.4%	March 3, 2025
Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability	Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter. CVE-2014-2120 Exploit Probability: 63.9%	November 12, 2024
Cisco ASA and FTD Denial-of-Service Vulnerability	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) of the RAVPN service. CVE-2024-20481 Exploit Probability: 11.1%	October 24, 2024
Cisco NX-OS Command Injection Vulnerability	Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device. CVE-2024-20399 Exploit Probability: 0.8%	July 2, 2024
Cisco ASA and FTD Denial of Service Vulnerability	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition. CVE-2024-20353 Exploit Probability: 19.5%	April 24, 2024
Cisco ASA and FTD Privilege Escalation Vulnerability	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root. CVE-2024-20359 Exploit Probability: 0.2%	April 24, 2024
Cisco ASA and FTD Information Disclosure Vulnerability	Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations. CVE-2020-3259 Exploit Probability: 69.7%	February 15, 2024
Cisco IOS XE Web UI Unspecified Vulnerability	Cisco IOS XE contains an unspecified vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity. CVE-2023-20273 Exploit Probability: 92.4%	October 23, 2023
Cisco IOS XE Web UI Command Injection Vulnerability	Cisco IOS XE contains a command injection vulnerability in the web user interface that could allow a remote, authenticated attacker to inject commands that can be executed as the root user. CVE-2021-1435 Exploit Probability: 0.4%	October 19, 2023
Cisco IOS XE Web UI Privilege Escalation Vulnerability	Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device. CVE-2023-20198 Exploit Probability: 94.0%	October 16, 2023

Of the known exploited vulnerabilities above, 3 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 6 known exploited Cisco vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

Top 10 Riskiest Cisco Vulnerabilities

Based on the current exploit probability, these Cisco vulnerabilities are on CISA's Known Exploited vulnerabilities list (KEV) and are ranked by the current EPSS exploit probability.

Rank	CVE	EPSS	Vulnerability
1	CVE-2020-3452	94.5%	Cisco Adaptive Security Appliance and Cisco Fire Power Threat Defense directory traversal sensitive
2	CVE-2018-0296	94.4%	Cisco Adaptive Security Appliance Firepower Threat Defense Denial-of-Service/Directory Traversal vul
3	CVE-2019-1653	94.4%	Cisco RV320 and RV325 Routers Improper Access Control Vulnerability (COVID-19-CTI list)
4	CVE-2021-1497	94.4%	Cisco HyperFlex HX Command Injection Vulnerabilities
5	CVE-2017-3881	94.3%	Cisco IOS and IOS XE Remote Code Execution Vulnerability
6	CVE-2021-1498	94.2%	Cisco HyperFlex HX Command Injection Vulnerabilities
7	CVE-2023-20198	94.0%	Cisco IOS XE Web UI Privilege Escalation Vulnerability
8	CVE-2018-0171	93.0%	Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability
9	CVE-2019-1652	93.0%	Cisco Small Business Routers Improper Input Validation Vulnerability
10	CVE-2016-6415	93.0%	Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability

By the Year

In 2026 there have been 79 vulnerabilities in Cisco with an average score of 6.5 out of ten. Last year, in 2025 Cisco had 218 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Cisco in 2026 could surpass last years number. Last year, the average CVE base score was greater by 0.22

Year	Vulnerabilities	Average Score
2026	79	6.47
2025	218	6.69
2024	366	6.74
2023	271	6.83
2022	323	6.91
2021	620	6.82
2020	354	6.85
2019	524	6.78
2018	373	7.51

It may take a day or so for new Cisco vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Cisco Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-20118	Mar 11, 2026	Cisco NCS 5500/5700 NPU DoS via EPNI Aligner Int A vulnerability in the handling of an Egress Packet Network Interface (EPNI) Aligner interrupt in Cisco IOS XR Software for Cisco Network Convergence System (NCS) 5500 Series with NC57 line cards and Cisco NCS 5700 Routers and Cisco IOS XR Software for Third Party Software could allow an unauthenticated, remote attacker to cause the network processing unit (NPU) and ASIC to stop processing, preventing traffic from traversing the interface. This vulnerability is due to the corruption of packets in specific cases when an EPNI Aligner interrupt is triggered while an affected device is experiencing heavy transit traffic. An attacker could exploit this vulnerability by sending a continuous flow of crafted packets to an interface of the affected device. A successful exploit could allow the attacker to cause persistent, heavy packet loss, resulting in a denial of service (DoS) condition. Note: If active exploitation of this vulnerability is suspected, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider. Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. This change was made because the affected device operates within a critical network segment where compromise could lead to significant disruption or exposure, thereby elevating the overall risk beyond the base technical severity.	Internetwork Operating System (IOS)
CVE-2026-20117	Mar 11, 2026	CVE-2026-20117: Unauth XSS in Cisco CCX Web UI A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability exists because the web-based management interface of an affected system does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.	Unified Contact Center Express
CVE-2026-20116	Mar 11, 2026	Cisco Finesse UI XSS in WebUI Allows Remote Attacker Exec A vulnerability in the web-based management interface of  Cisco Finesse, Cisco Packaged Contact Center Enterprise (Packaged CCE), Cisco Unified Contact Center Enterprise (Unified CCE), Cisco Unified Contact Center Express (Unified CCX), and Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability exists because the web-based management interface of an affected system does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.	Unified Contact Center Express
CVE-2026-20046	Mar 11, 2026	Privilege Escalation via CLI Task Group Misassignment in Cisco IOS XR A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device. This vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by using the CLI command to bypass the task group–based checks. A successful exploit could allow the attacker to elevate privileges and perform actions on an affected device without authorization checks.	Internetwork Operating System (IOS)
CVE-2026-20074	Mar 11, 2026	Cisco IOS XR IS-IS Process Crash via Malformed Packets A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) multi-instance routing feature of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the IS-IS process to restart unexpectedly. This vulnerability is due to insufficient input validation of ingress IS-IS packets. An attacker could exploit this vulnerability by sending crafted IS-IS packets to an affected device after forming an adjacency. A successful exploit could allow the attacker to cause the IS-IS process to restart unexpectedly, resulting in a temporary loss of connectivity to advertised networks and a denial of service (DoS) condition. Note: The IS-IS protocol is a routing protocol. To exploit this vulnerability, an attacker must be Layer 2-adjacent to the affected device and must have formed an adjacency.	Internetwork Operating System (IOS)
CVE-2026-20040	Mar 11, 2026	Cisco IOS XR CLI Local Authenticated Privilege Escalation via Argument Validation A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the prompt. A successful exploit could allow the attacker to elevate privileges to root and execute arbitrary commands on the underlying operating system.	Internetwork Operating System (IOS)
CVE-2026-20064	Mar 04, 2026	Cisco FTD CLI DoS via Improper Input Validation A vulnerability in of Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to cause the device to unexpectedly reload, causing a denial of service (DoS) condition. This vulnerability is due to improper validation of user-supplied input. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the CLI prompt. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
CVE-2026-20025	Mar 04, 2026	OSPF LSU Heap Corruption DoS in Cisco Secure Firewall ASA/FTD A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. To exploit this vulnerability, the attacker must have the OSPF secret key. This vulnerability is due to insufficient input validation when processing OSPF link-state update (LSU) packets. An attacker could exploit this vulnerability by sending crafted OSPF LSU packets. A successful exploit could allow the attacker to corrupt the heap, causing the device to reload, resulting in a DoS condition.	Adaptive Security Appliance
CVE-2026-20024	Mar 04, 2026	Cisco Secure Firewall ASA/FTD OSPF DoS via Auth Attack A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. To exploit this vulnerability, the attacker must have the OSPF secret key. This vulnerability is due to heap corruption in OSPF when parsing packets. An attacker could exploit this vulnerability by sending crafted packets to the OSPF service. A successful exploit could allow the attacker to corrupt the heap, causing the affected device to reload, resulting in a DoS condition.	Adaptive Security Appliance
CVE-2026-20023	Mar 04, 2026	Cisco ASA/FTD OSPF Memory Corruption Causing DoS A vulnerability in the OSPF protocol of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, adjacent attacker to corrupt memory on an affected device, resulting in a denial of service (DoS) condition. This vulnerability is due to memory corruption when parsing OSPF protocol packets. An attacker could exploit this vulnerability by sending crafted OSPF packets to an affected device. A successful exploit could allow the attacker to cause memory corruption causing the affected device to reboot, resulting in a DoS condition.	Adaptive Security Appliance
CVE-2026-20022	Mar 04, 2026	DoS via OSPF LSU Overflow in Cisco Secure Firewall ASA/FTD A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition when OSPF canonicalization debug is enabled by using the command debug ip ospf canon. This vulnerability is due to insufficient input validation when processing OSPF LSU packets. An attacker could exploit this vulnerability by sending crafted unauthenticated OSPF packets. A successful exploit could allow the attacker to write to memory outside of the packet data, causing the device to reload, resulting in a DoS condition.	Adaptive Security Appliance
CVE-2026-20021	Mar 04, 2026	OSPF Authenticated Adjacent DoS via Memory Exhaustion in Cisco ASA/FTD A vulnerability in the OSPF protocol of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, adjacent attacker to exhaust memory on an affected device, resulting in a denial of service (DoS) condition. This vulnerability is due to improperly validating input by the OSPF protocol when parsing packets. An attacker could exploit this vulnerability by by sending crafted OSPF packets to an affected device. A successful exploit could allow the attacker to exhaust memory on the affected device, resulting in a DoS condition.	Adaptive Security Appliance
CVE-2026-20020	Mar 04, 2026	Cisco Secure Firewall ASA/FTD OSPF DoS via Buffer Overflow A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. If OSPF authentication is enabled, the attacker must know the secret key to exploit this vulnerability. This vulnerability is due to insufficient input validation when processing OSPF update packets. An attacker could exploit this vulnerability by sending crafted OSPF update packets. A successful exploit could allow the attacker to create a buffer overflow, causing the affected device to reload, resulting in a DoS condition.	Adaptive Security Appliance
CVE-2026-20016	Mar 04, 2026	Cisco FXOS CLI Auth Local RCE (root) A vulnerability in the Cisco FXOS Software CLI feature for Cisco Secure Firewall ASA Software and Secure FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. To exploit this vulnerability, the attacker must have valid administrative credentials on an affected device. This vulnerability is due to insufficient input validation of user-supplied command arguments. An attacker could exploit this vulnerability by submitting crafted input for specific CLI commands. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges.
CVE-2026-20073	Mar 04, 2026	Cisco ASA/FTD: Cluster Replication RMEM Bypass (CVE-2026-20073) A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should be denied through an affected device. This vulnerability is due to improper error handling when an affected device that is joining a cluster runs out of memory while replicating access control rules. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks.	Adaptive Security Appliance
CVE-2026-20102	Mar 04, 2026	Cisco Secure Firewall ASA/FTD XSS via Unvalidated SAML 2.0 SSO A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the SAML feature and access sensitive, browser-based information. This vulnerability is due to insufficient input validation of multiple HTTP parameters. An attacker could exploit this vulnerability by persuading a user to access a malicious link. A successful exploit could allow the attacker to conduct a reflected XSS attack through an affected device.	Adaptive Security Appliance
CVE-2026-20070	Mar 04, 2026	VPN Web Services XSS in Cisco Secure Firewall ASA/FTD A vulnerability in the VPN web services component of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a browser that is accessing an affected device.  This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by persuading a user to follow a link to a malicious website that is designed to submit malicious input to the affected application. A successful exploit could allow the attacker to execute arbitrary HTML or script code in the browser in the context of the VPN web server.	Adaptive Security Appliance
CVE-2026-20069	Mar 04, 2026	VPN Webservices XSS in Cisco Secure Firewall ASA/FTD Remote Attack A vulnerability in the VPN web services component of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct browser-based attacks against users of an affected device. This vulnerability is due to improper validation of HTTP requests. An attacker could exploit this vulnerability by persuading a user to visit a website that is designed to pass malicious HTTP requests to a device that is running Cisco Secure Firewall ASA Software or Cisco Secure FTD Software and has web services endpoints supporting VPN features enabled. A successful exploit could allow the attacker to reflect malicious input from the affected device to the browser that is in use and conduct browser-based attacks, including cross-site scripting (XSS) attacks. The attacker is not able to directly impact the affected device.	Adaptive Security Appliance
CVE-2026-20068	Mar 04, 2026	Cisco Snort 3 D.E. DoS via Malformed RPC Parsing Multiple Cisco products are affected by a vulnerability in the Snort 3 detection engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to incomplete error checking when parsing remote procedure call (RPC) data. An attacker could exploit this vulnerability by sending crafted RPC packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine unexpectedly restarts.	Cyber Vision
CVE-2026-20067	Mar 04, 2026	Cisco Snort 3 DoS via MDNS HTTP Header Parsing Multiple Cisco products are affected by a vulnerability in the Snort 3 detection engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection.  This vulnerability is due to incomplete error checking when parsing the Multicast DNS fields of the HTTP header. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine unexpectedly restarts.	Cyber Vision
CVE-2026-20066	Mar 04, 2026	DoS via JSTokenizer Exploit in Cisco Snort 3 Detection Engine Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to an error in the JSTokenizer normalization logic when the HTTP inspection normalizes JavaScript. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection that is parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine restarts unexpectedly. JSTokenizer is not enabled by default.
CVE-2026-20065	Mar 04, 2026	DoS via Snort3 Engine Restart in Cisco Devices Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to an error in the binder module initialization logic of the Snort Detection Engine. An attacker could exploit this vulnerability by sending certain packets through an established connection that is parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine restarts unexpectedly.
CVE-2026-20063	Mar 04, 2026	Cisco Secure FTD CLI: Local Privilege Escalation via Command Injection A vulnerability in the CLI of Cisco Secure FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as root. To exploit this vulnerability, the attacker must have valid administrative credentials on an affected device. This vulnerability is due to insufficient input validation of user-supplied command arguments. An attacker could exploit this vulnerability by submitting crafted input for a specific CLI command. A successful exploit could allow the attacker to execute commands on the underlying operating system as root.
CVE-2026-20058	Mar 04, 2026	Cisco Snort 3 Detection Engine: VBA Decompression DoS via Improper Error Checking Multiple Cisco products are affected by vulnerabilities in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash. These vulnerabilities are due to improper error checking when decompressing VBA data. An attacker could exploit these vulnerabilities by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to unexpectedly restart, causing a DoS condition.
CVE-2026-20057	Mar 04, 2026	Snort 3 VBA Decompression DoS (CVE-2026-20057) Multiple Cisco products are affected by a vulnerability in the Snort 3 Visual Basic for Applications (VBA) feature which could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.    This vulnerability is due to lack of proper error checking when decompressing VBA data. An attacker could exploit this vulnerability by sending a crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to unexpectedly restart causing a a denial of service (DoS) condition.	Cyber Vision
CVE-2026-20054	Mar 04, 2026	Cisco Snort 3 VBA Crash DoS via Unauth Remote Attacker Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.  This vulnerability is due to improper error checking when decompressing VBA data. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to enter an infinite loop, causing a DoS condition.	Cyber Vision
CVE-2026-20053	Mar 04, 2026	Cisco Snort 3 DoS via Improper VBA Decompress Range Checking Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash. This vulnerability is due to improper range checking when decompressing VBA data, which is user controlled. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause an overflow of heap data, which could cause a DoS condition.	Cyber Vision
CVE-2026-20052	Mar 04, 2026	CVE-2026-20052: Remote DoS via Memory Leak in Cisco Secure Firewall Snort 3 Engine A vulnerability in the memory management handling for the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. This vulnerability is due to a logic error in memory management when a device is performing Snort 3 SSL packet inspection. An attacker could exploit this vulnerability by sending crafted SSL packets through an established connection to be parsed by the Snort 3 Detection Engine. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when the Snort 3 Detection Engine unexpectedly restarts.
CVE-2026-20050	Mar 04, 2026	Cisco FTD SSL Decrypt Do Not Decrypt DoS via TLS1.2 A vulnerability in the Do Not Decrypt exclusion feature of the SSL decryption feature of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper memory management during the inspection of TLS 1.2 encrypted traffic. An attacker could exploit this vulnerability by sending crafted TLS 1.2 encrypted traffic through an affected device. A successful exploit could allow the attacker to cause a reload of an affected device. Note: This vulnerability only affects traffic that is encrypted by TLS 1.2. Other versions of TLS are not affected.
CVE-2026-20017	Mar 04, 2026	Local Auth Cmd Injection in Cisco Secure FTD CLI Root Exec A vulnerability in the CLI of Cisco Secure FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as root. To exploit this vulnerability, the attacker must have valid administrative credentials on an affected device. This vulnerability is due to insufficient input validation of user-supplied command arguments. An attacker could exploit this vulnerability by submitting crafted input for a specific CLI command. A successful exploit could allow the attacker to execute commands on the underlying operating system as root.
CVE-2026-20018	Mar 04, 2026	Cisco Secure Firewall FMC/FTD sftunnel Path Traversal: Auth File Write A vulnerability in the sftunnel functionality of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with administrative privileges to write arbitrary files as root on the underlying operating system. This vulnerability is due to insufficient validation of the directory path during file synchronization. An attacker could exploit this vulnerability by crafting a directory path outside of the expected file location. A successful exploit could allow the attacker to create or replace any file on the underlying operating system.	Secure Firewall Management Center
CVE-2026-20007	Mar 04, 2026	Cisco Secure FTD: Snort Rule Bypass via Deep Packet Logic Error A vulnerability in the Snort 2 and Snort 3 deep packet inspection of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured Snort rules and allow traffic onto the network that should have been dropped. This vulnerability is due to a logic error in the integration of the Snort Engine rules with Cisco Secure FTD Software that could allow different Snort rules to be hit when deep inspection of the packet is performed for the inner and outer connections. An attacker could exploit this vulnerability by sending crafted traffic to a targeted device that would hit configured Snort rules. A successful exploit could allow the attacker to send traffic to a network where it should have been denied.
CVE-2026-20006	Mar 04, 2026	DoS via TLS crash in Snort3 Engine of Cisco Secure FTD A vulnerability in the TLS cryptography functionality of the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to unexpectedly restart, resulting in a denial of service (DoS) condition. This vulnerability is due to improper implementation of the TLS protocol. An attacker could exploit this vulnerability by sending a crafted TLS packet to an affected system. A successful exploit could allow the attacker to cause a device that is running Cisco Secure FTD Software to drop network traffic, resulting in a DoS condition.  Note: TLS 1.3 is not affected by this vulnerability.
CVE-2026-20149	Mar 04, 2026	XSS in Cisco Webex from improper input filtering A vulnerability in Cisco Webex could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. Cisco has addressed this vulnerability, and no customer action is needed. This vulnerability was due to improper filtering of user-supplied input. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to follow a malicious link. A successful exploit could have allowed the attacker to conduct an XSS attack against the targeted user.	Webex Meetings
CVE-2026-20082	Mar 04, 2026	Cisco ASA TCP SYN Flood DoS via Mismanaged Connection Limits A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause incoming TCP SYN packets to be dropped incorrectly. This vulnerability is due to improper handling of new, incoming TCP connections that are destined to management or data interfaces when the device is under a TCP SYN flood attack. An attacker could exploit this vulnerability by sending a crafted stream of traffic to an affected device. A successful exploit could allow the attacker to prevent all incoming TCP connections to the device from being established, including remote management access, Remote Access VPN (RAVPN) connections, and all network protocols that are TCP-based. This results in a denial of service (DoS) condition for affected features.	Adaptive Security Appliance
CVE-2026-20062	Mar 04, 2026	Auth Bypass CLI ASA SCP Context File Copy A vulnerability in the CLI of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software in multiple context mode could allow an authenticated, local attacker with administrative privileges in one context to copy files to or from another context, including configuration files. This vulnerability is due to improper access controls for Secure Copy Protocol (SCP) operations when the CiscoSSH stack is enabled. An attacker could exploit this vulnerability by authenticating to a non-admin context of the device and issuing crafted SCP copy commands in that non-admin context. A successful exploit could allow the attacker to read, create, or overwrite sensitive files that belong to another context, including the admin and system contexts. The attacker cannot directly impact the availability of services pertaining to other contexts. To exploit this vulnerability, the attacker must have valid administrative credentials for a non-admin context. Note: An attacker cannot list or enumerate files from another context and would need to know the exact file path, which increases the complexity of a successful attack.	Adaptive Security Appliance
CVE-2026-20049	Mar 04, 2026	Cisco ASA/FTD GCM-IKEv2 Memory Overrun Causing DoS A vulnerability in the processing of Galois/Counter Mode (GCM)-encrypted Internet Key Exchange version 2 (IKEv2) IPsec traffic of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to the allocation of an insufficiently sized block of memory. An attacker could exploit this vulnerability by sending crafted GCM-encrypted IPsec traffic to an affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device, resulting in a DoS condition. To exploit this vulnerability, the attacker must have valid credentials to establish a VPN connection with the affected device.	Adaptive Security Appliance
CVE-2026-20015	Mar 04, 2026	Cisco ASA/FTD IKEv2 DoS via Memory Leak A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device that may impact the availability of services to devices elsewhere in the network. This vulnerability is due to a memory leak when parsing IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker to exhaust resources, causing a DoS condition that will eventually require the device to be manually reloaded.	Adaptive Security Appliance
CVE-2026-20014	Mar 04, 2026	Cisco ASA/FTD IKEv2 Authenticated DoS via Crafted Packets A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, remote attacker with valid VPN user credentials to cause a DoS condition on an affected device that may also impact the availability of services to devices elsewhere in the network. This vulnerability is due to the improper processing of IKEv2 packets. An attacker could exploit this vulnerability by sending crafted, authenticated IKEv2 packets to an affected device. A successful exploit could allow the attacker to exhaust memory, causing the device to reload.	Adaptive Security Appliance
CVE-2026-20013	Mar 04, 2026	Cisco Secure Firewall ASA/FTD IKEv2 DoS A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device that may also impact the availability of services to devices elsewhere in the network. This vulnerability is due to memory exhaustion caused by not freeing memory during IKEv2 packet processing. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker to exhaust resources, causing a DoS condition that will eventually require the device to manually reload.	Adaptive Security Appliance
CVE-2026-20106	Mar 04, 2026	Cisco ASA/FTD Mem Exhaustion DoS via SSL VPN A vulnerability in the Remote Access SSL VPN, HTTP management and MUS functionality, of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust device memory resulting in a denial of service (DoS) condition requiring a manual reboot. This vulnerability is due to trusting user input without validation. An attacker could exploit this vulnerability by sending crafted packets to the Remote Access SSL VPN server. A successful exploit could allow the attacker to cause the device to stop responding, resulting in a DoS condition.	Adaptive Security Appliance
CVE-2026-20105	Mar 04, 2026	SSL VPN Memory Exhaust DoS on Cisco Secure Firewall ASA/FTD A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with a valid VPN connection to exhaust device memory resulting in a denial of service (DoS) condition.This does not affect the management or MUS interfaces. This vulnerability is due to trusting user input without validation. An attacker could exploit this vulnerability by sending crafted packets to the Remote Access SSL VPN server. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.	Adaptive Security Appliance
CVE-2026-20103	Mar 04, 2026	Cisco ASA/FTD Remote Access SSL VPN DoS via Memory Exhaustion A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust device memory resulting in a denial of service (DoS) condition to new Remote Access SSL VPN connections. This does not affect the management interface, though it may become temporarily unresponsive. This vulnerability is due to trusting user input without validation. An attacker could exploit this vulnerability by sending crafted packets to the Remote Access SSL VPN server. A successful exploit could allow the attacker to cause the device web interface to stop responding, resulting in a DoS condition.	Adaptive Security Appliance
CVE-2026-20101	Mar 04, 2026	Cisco Secure Firewall ASA/FTD SAML SSO DoS via Device Reload A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition. This vulnerability is due to insufficient error checking when processing SAML messages. An attacker could exploit this vulnerability by sending crafted SAML messages to the SAML service. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.	Adaptive Security Appliance
CVE-2026-20100	Mar 04, 2026	LUA interpreter DoS via crafted HTTP on Cisco ASA VPN A vulnerability in the LUA interperter of the Remote Access SSL VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with a valid VPN connection to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This does not affect the management or MUS interfaces. This vulnerability is due to trusting user input without validation in the LUA interprerter. An attacker could exploit this vulnerability by sending crafted HTTP packets to the Remote Access SSL VPN server. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.	Adaptive Security Appliance
CVE-2026-20003	Mar 04, 2026	Authenticated SQL Injection via REST API in Cisco Secure FMC A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to inadequate validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted requests to an affected device. A successful exploit could allow the attacker to obtain read access to the database and read certain files on the underlying operating system. To exploit this vulnerability, the attacker would need valid user credentials with any of the following roles: Administrator Security approver Intrusion admin Access admin Network admin	Secure Firewall Management Center
CVE-2026-20002	Mar 04, 2026	SQLi in Cisco Secure FMC UI Enables Authenticated DB Access A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to inadequate validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted requests to an affected device. A successful exploit could allow the attacker to obtain full access to the database and read certain files on the underlying operating system. To exploit this vulnerability, the attacker would need valid user credentials.	Secure Firewall Management Center
CVE-2026-20131	Mar 04, 2026	Cisco FMC Web UI Insecure Deserialization - Arbitrary Code Exec as Root A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.	Secure Firewall Management Center
CVE-2026-20039	Mar 04, 2026	Cisco Secure Firewall VPN Web Server DoS via Memory Leak A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to ineffective memory management of the VPN web server. An attacker could exploit this vulnerability by sending a large number of crafted HTTP requests to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.	Adaptive Security Appliance
CVE-2026-20044	Mar 04, 2026	Authenticated Local Privilege Escalation in Cisco FMC Lockdown Mode A vulnerability in the lockdown mechanism of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, local attacker to perform arbitrary commands as root. This vulnerability is due to insufficient restrictions on remediation modules while in lockdown mode. An attacker could exploit this vulnerability by sending crafted input to the system CLI of the affected device. A successful exploit could allow the attacker to run arbitrary commands or code as root, even when the system is in lockdown mode. To exploit this vulnerability, the attacker must have valid administrative credentials.	Secure Firewall Management Center