Quick answers
- Is CVE-2026-20014 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-20014 being exploited in the wild.
- How severe is CVE-2026-20014?
- High severity, with a CVSS score of 7.7, published 4 March 2026.
- Which products and versions are affected?
- Cisco Secure Firewall ASA Software <UNKNOWN>; Cisco Secure Firewall Threat Defense Software <UNKNOWN>.
- Is there a fix for CVE-2026-20014?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-20014 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-20014?
- Check whether you run Cisco Secure Firewall ASA Software or Cisco Secure Firewall Threat Defense Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
CVE-2026-20014 is a denial-of-service vulnerability in the IKEv2 packet processing logic of Cisco Secure Firewall ASA and FTD software, caused by improper handling that allows memory exhaustion (CWE-401 resource exhaustion). The vulnerability requires an authenticated remote attacker with valid VPN credentials to send crafted IKEv2 packets to an affected device; IKEv2 must be enabled on at least one interface. Successful exploitation exhausts device memory and triggers a forced reload, temporarily making the firewall unavailable and impacting all downstream network services. Cisco has released patches addressing this vulnerability; no workarounds are available.
Affected products
- Cisco Secure Firewall ASA Software <UNKNOWN>
- Cisco Secure Firewall Threat Defense Software <UNKNOWN>
Timeline
- 2026-03-04: disclosed: Cisco Security Advisory published