Is CVE-2026-20050 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20050 being exploited in the wild.

How severe is CVE-2026-20050?

Medium severity, with a CVSS score of 6.8, published 4 March 2026.

Which products and versions are affected?

Cisco Secure Firewall Threat Defense Multiple releases (see Cisco Software Checker for affected versions).

Is there a fix for CVE-2026-20050?

A patch was published on 2026-03-04: Cisco released software updates on the publication date Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-20050 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-20050?

Check whether you run Cisco Secure Firewall Threat Defense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20050: Cisco Secure Firewall Threat Defense SSL decryption denial of service

CVE-2026-20050 · Severity: medium · CVSS 6.8 · Published 2026-03-04

Cisco Secure Firewall Threat Defense (FTD) is a network security appliance that inspects encrypted traffic to detect threats. A flaw in its SSL decryption feature causes the device to crash when it receives specially crafted TLS 1.2 encrypted traffic, resulting in a denial of service that disrupts network security protection and business operations. No workaround is available; devices require a software patch to fix the issue.

Technologies: Cisco Secure Firewall Threat Defense. Vendors: Cisco.

Quick answers

Is CVE-2026-20050 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20050 being exploited in the wild.
How severe is CVE-2026-20050?: Medium severity, with a CVSS score of 6.8, published 4 March 2026.
Which products and versions are affected?: Cisco Secure Firewall Threat Defense Multiple releases (see Cisco Software Checker for affected versions).
Is there a fix for CVE-2026-20050?: A patch was published on 2026-03-04: Cisco released software updates on the publication date Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20050 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20050?: Check whether you run Cisco Secure Firewall Threat Defense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a memory management flaw (CWE-404) in the Do Not Decrypt exclusion feature of the SSL decryption engine affecting TLS 1.2 traffic inspection. An unauthenticated remote attacker can exploit it by sending crafted TLS 1.2 encrypted packets through the device without requiring authentication or user interaction. The attack results in improper memory handling that causes a device reload, achieving denial of service. The vulnerability only affects TLS 1.2; other TLS versions are not impacted. Cisco has released software patches to address the vulnerability, and no workarounds are available.

Affected products

Cisco Secure Firewall Threat Defense Multiple releases (see Cisco Software Checker for affected versions)

Timeline

2026-03-04: disclosed
2026-03-04: patched: Cisco released software updates on the publication date

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-dnd-dos-bpEcg7B7

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.