CVE-2026-20329

Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Exceptional Conditions Handling Vulnerabilities

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.19.9Critical EPSS percentile36th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 0 sources FixNone yetNo fix or workaround published

Published 2026-09-16Updated 2026-09-18Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Inventory every installation of cisco secure firewall adaptive security appliance (asa) software, cisco secure firewall threat defense (ftd) software, and cisco secure firewall management center (fmc), including its installed version and who can log in.
Restrict management access immediately to named administrators on trusted internal networks or a private management connection; remove unnecessary accounts and review administrator permissions.
No fixed version has been announced in the available findings; check Cisco's advisory for CVE-2026-20329 and apply the exact fixed release as soon as Cisco publishes it.
Review firewall and management-system logs for unexpected administrator logins, configuration exports or changes, new accounts, and unexplained restarts.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.   The vulnerabilities tracked by CVE-2026-20329 are related to issues concerning improper handling of exceptional conditions that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-703.

In plain language

Written by AI from the record

This is a critical flaw in Cisco firewall software; businesses using the affected products should treat it as urgent because a public exploit is available and no fix information is available.

CVE-2026-20329 is a CVSS 9.9 exceptional-conditions handling vulnerability (CWE-703) in Cisco firewall products that may enable a low-privileged attacker to compromise confidentiality, integrity, and availability across security scope boundaries.

If you're affected

Firewall management takeover
Network security disruption
Sensitive data exposure
Configuration tampering
Service outages

What is it

This is a mistake in how the software handles unusual situations. Think of a secure building whose control room can be pushed into an unsafe state by someone with limited access: the result can be control over the building's locks, records, and operations.

Who is affected

This matters to you if you run cisco secure firewall adaptive security appliance (asa) software, cisco secure firewall threat defense (ftd) software, or cisco secure firewall management center (fmc). It is especially important to review systems where users with limited administrator access can reach the firewall or its management interface.

How urgent is it

A public exploit is available, giving attackers a known way to target this issue. Treat this as a red-priority incident: reduce access to the affected systems now and prepare to install Cisco's fix when it becomes available.

What to do — in detail

Confirm exposure by identifying all ASA, FTD, and FMC deployments; record their software versions, enabled management interfaces, administrator accounts, and the networks that can reach them. The available findings do not provide affected-version ranges or fixed versions, so validate each deployment against Cisco's CVE-2026-20329 advisory when it is published or updated.

No target fixed release or branch-specific upgrade path is available in the findings. Do not assume that a routine update contains the correction; obtain Cisco's stated fixed version for each supported branch, review its release notes for upgrade requirements or breaking changes, and test the upgrade on a representative system where practical.

Until a patch is available, allow management access only from a dedicated trusted administration network or private access path, remove unneeded privileged accounts, and apply least privilege to remaining accounts. Review authentication, configuration-change, export, and system-event logs for unexpected activity; preserve relevant logs and engage Cisco support or incident response if suspicious changes are found. CISA has not listed this CVE in KEV, so no CISA remediation due date applies.

Technical context

Severity is CVSS 9.9 (Critical): CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The reported weakness is CWE-703, improper handling of exceptional conditions. The vector is network-based, requires low privileges, requires no user interaction, and has scope change with high confidentiality, integrity, and availability impact. A public exploit is available; exploit maturity is therefore public/weaponized. CISA KEV does not list this CVE. EPSS is 0.4% (38th percentile) and flat; this is a prediction rather than evidence of confirmed exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS36th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 36th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 2 days, from the signal feeds we watch.

2026-09-18Record updatedrecord updated
2026-09-17Record updated
2026-09-16Publishedweakness classified, record updated

Affected products

Ciscocommercial · USaka cisco systems inc., cisco systems

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Scored 9.9 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable