Is CVE-2026-20022 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20022 being exploited in the wild.

How severe is CVE-2026-20022?

Medium severity, with a CVSS score of 6.1, published 4 March 2026.

Which products and versions are affected?

Cisco Secure Firewall ASA Software Multiple versions affected; see vendor advisory for specific vulnerable releases; Cisco Secure Firewall Threat Defense Software Multiple versions affected; see vendor advisory for specific vulnerable releases.

Is there a fix for CVE-2026-20022?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-20022 attacked?

It is attacked from the adjacent network.

Am I affected by CVE-2026-20022?

Check whether you run Cisco Secure Firewall ASA Software or Cisco Secure Firewall Threat Defense Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20022: Cisco Secure Firewall ASA and FTD OSPF DoS via insufficient input validation

CVE-2026-20022 · Severity: medium · CVSS 6.1 · Published 2026-03-04

Cisco Secure Firewall ASA and FTD devices, which protect enterprise networks by routing traffic securely, contain multiple vulnerabilities in their OSPF (routing protocol) implementation. An attacker on the same network segment can send specially crafted packets to force these devices to crash unexpectedly, disrupting all network traffic that depends on them and leaving organizations unable to route traffic or enforce security policies.

Technologies: Cisco Secure Firewall ASA Software, Cisco Secure Firewall Threat Defense Software. Vendors: Cisco.

Quick answers

Is CVE-2026-20022 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20022 being exploited in the wild.
How severe is CVE-2026-20022?: Medium severity, with a CVSS score of 6.1, published 4 March 2026.
Which products and versions are affected?: Cisco Secure Firewall ASA Software Multiple versions affected; see vendor advisory for specific vulnerable releases; Cisco Secure Firewall Threat Defense Software Multiple versions affected; see vendor advisory for specific vulnerable releases.
Is there a fix for CVE-2026-20022?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20022 attacked?: It is attacked from the adjacent network.
Am I affected by CVE-2026-20022?: Check whether you run Cisco Secure Firewall ASA Software or Cisco Secure Firewall Threat Defense Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple vulnerabilities exist in the OSPF protocol processing of Cisco Secure Firewall ASA and FTD Software due to insufficient input validation and heap corruption when parsing OSPF packets (CVE-2026-20020, CVE-2026-20021, CVE-2026-20022, CVE-2026-20023, CVE-2026-20024, CVE-2026-20025). The vulnerabilities include buffer overflows, heap corruption, and out-of-bounds memory writes when processing crafted OSPF update and link-state update packets. CVE-2026-20022 specifically can be triggered by an unauthenticated adjacent attacker when OSPF canonicalization debug is enabled; other variants require OSPF authentication. An adjacent attacker can exploit these by sending malformed OSPF packets, causing the affected device to reload and resulting in a denial of service. Cisco has released software updates to address these vulnerabilities; no workarounds are available.

Affected products

Cisco Secure Firewall ASA Software Multiple versions affected; see vendor advisory for specific vulnerable releases
Cisco Secure Firewall Threat Defense Software Multiple versions affected; see vendor advisory for specific vulnerable releases

Timeline

2026-03-04: disclosed: Cisco Security Advisory published

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ospf-ZH8PhbSW

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.