# CVE-2026-20069: Cisco ASA and FTD Request Smuggling in VPN Web Services

Source: https://junglewise.ai/threats/cve-2026-20069-cisco-asa-and-ftd-request-smuggling-in-vpn-web-services  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-04. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-20069 · Severity: medium · CVSS 4.3 · Published 2026-03-04

A vulnerability in Cisco's firewall software could allow an attacker to perform browser-based attacks against users of the VPN service. By tricking a user into visiting a malicious website, an attacker can reflect harmful code through the firewall and into the user's browser. This could lead to unauthorized actions being performed on behalf of the user, though the firewall device itself is not directly compromised.

Technologies: [Cisco Adaptive Security Appliance Software](https://junglewise.ai/threats/technologies/secure-firewall-asa-software), [Cisco Secure Firewall Threat Defense Software](https://junglewise.ai/threats/technologies/firepower-threat-defense-software). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20069 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20069 being exploited in the wild.

**How severe is CVE-2026-20069?** Medium severity, with a CVSS score of 4.3, published 4 March 2026.

**Which products and versions are affected?** Cisco Adaptive Security Appliance Software 9.12.1 to 9.16.4.85, 9.17.1 to 9.18.4.66, 9.19.1 to 9.20.4, 9.22.1.1 to 9.22.2.4, 9.23.1 to 9.23.1.7; Cisco Secure Firewall Threat Defense Software 6.4.0 to 7.0.9, 7.1.0 to 7.2.11, 7.3.0 to 7.4.3, 7.6.0 to 7.6.4, 7.7.0 to 7.7.11.

**Is there a fix for CVE-2026-20069?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20069 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20069?** Check whether you run Cisco Adaptive Security Appliance Software or Cisco Secure Firewall Threat Defense Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in the VPN web services component of Cisco ASA and FTD software (CWE-444) arises from improper validation of HTTP requests. An unauthenticated, remote attacker can exploit this by persuading a user to visit a malicious website that sends specially crafted HTTP requests to the firewall's VPN endpoints (specifically SSL VPN or IKEv2 with client services enabled). This results in a client-side request smuggling or reflected XSS attack where malicious input is reflected back to the user's browser. While the attacker cannot directly impact the device's integrity or availability, they can execute scripts in the context of the user's session. Fixed software versions have been released to address this issue.

## Affected products

- Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.12.1 to 9.16.4.85, 9.17.1 to 9.18.4.66, 9.19.1 to 9.20.4, 9.22.1.1 to 9.22.2.4, 9.23.1 to 9.23.1.7
- Cisco Secure Firewall Threat Defense (FTD) Software 6.4.0 to 7.0.9, 7.1.0 to 7.2.11, 7.3.0 to 7.4.3, 7.6.0 to 7.6.4, 7.7.0 to 7.7.11

## Timeline

- 2026-03-04: advisory: Initial advisory published by Cisco
- 2026-03-04: disclosed
- 2026-06-02: other: NVD analysis and CPE information updated

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-desync-n5AVzEQw](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-desync-n5AVzEQw)

## Related threats

- [Cisco Snort 3 GRE detection engine denial of service](https://junglewise.ai/threats/cve-2026-20179-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Secure Firewall improper adherence to coding standards](https://junglewise.ai/threats/cve-2026-20334-cisco-secure-firewall-improper-adherence-to-coding-standards)
- [Cisco Secure Firewall ASA/FTD/FMC incorrect comparison in security context](https://junglewise.ai/threats/cve-2026-20333-cisco-secure-firewall-asa-ftd-fmc-incorrect-comparison-in)
- [Cisco Secure Firewall ASA/FTD/FMC access control vulnerability](https://junglewise.ai/threats/cve-2026-20332-cisco-secure-firewall-asa-ftd-fmc-access-control-vulnerability)
- [Cisco Secure Firewall ASA and FTD DTLS denial of service](https://junglewise.ai/threats/cve-2026-20250-cisco-secure-firewall-asa-and-ftd-dtls-denial-of-service)