CVE-2026-20008: Cisco Secure Firewall ASA and FTD Lua code injection in CLI commands

CVE-2026-20008 · Severity: medium · CVSS 6 · Published 2026-03-04

Cisco Secure Firewall devices (ASA and FTD) contain a vulnerability in certain CLI commands that allows authenticated administrators to inject and execute arbitrary Lua code with root privileges. A malicious administrator could exploit this to gain complete control over the firewall's underlying operating system, compromising network security and enabling data theft or system takeover.

Technologies: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software. Vendors: Cisco.

Quick answers

Is CVE-2026-20008 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20008 being exploited in the wild.
How severe is CVE-2026-20008?
Medium severity, with a CVSS score of 6, published 4 March 2026.
Which products and versions are affected?
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software Multiple versions vulnerable; see Cisco Software Checker for affected releases; Cisco Secure Firewall Threat Defense (FTD) Software Multiple versions vulnerable; see Cisco Software Checker for affected releases.
Is there a fix for CVE-2026-20008?
A patch was published on 2026-03-04: Software updates available via Cisco Software Checker Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20008 attacked?
It is attacked with local access.
Am I affected by CVE-2026-20008?
Check whether you run Cisco Secure Firewall Adaptive Security Appliance (ASA) Software or Cisco Secure Firewall Threat Defense (FTD) Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a Lua code injection flaw (CWE-78: Improper Neutralization of Special Elements) in CLI command handling. The root cause is insufficient input sanitization of user-supplied parameters in a small subset of CLI commands. An authenticated attacker with valid Administrator credentials can craft malicious Lua code as a CLI parameter to inject arbitrary code that executes as the root user on the appliance's underlying operating system. The attack vector is local; no network connectivity is required. Cisco has released software updates to fix this vulnerability, and no workarounds are available.

Affected products

  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software Multiple versions vulnerable; see Cisco Software Checker for affected releases
  • Cisco Secure Firewall Threat Defense (FTD) Software Multiple versions vulnerable; see Cisco Software Checker for affected releases

Timeline

  • 2026-03-04: disclosed: Cisco Security Advisory published
  • 2026-03-04: patched: Software updates available via Cisco Software Checker

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.