Is CVE-2026-20101 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20101 being exploited in the wild.

How severe is CVE-2026-20101?

High severity, with a CVSS score of 8.6, published 4 March 2026.

Which products and versions are affected?

Cisco Secure Firewall ASA Software Affected versions available in Cisco advisory; see fixed software section; Cisco Secure Firewall Threat Defense Software Affected versions available in Cisco advisory; see fixed software section.

Is there a fix for CVE-2026-20101?

A patch was published on 2026-03: Software updates available from Cisco Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-20101 attacked?

It is attacked over the network.

Am I affected by CVE-2026-20101?

Check whether you run Cisco Secure Firewall ASA Software or Cisco Secure Firewall Threat Defense Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20101: Cisco Secure Firewall ASA and FTD SAML 2.0 SSO denial of service

CVE-2026-20101 · Severity: high · CVSS 8.6 · Published 2026-03-04

Cisco Secure Firewall devices (ASA and Threat Defense) include a SAML 2.0 single sign-on feature used to authenticate remote VPN users. A flaw in the SAML message processing can be exploited by an attacker to send specially crafted messages that cause the device to unexpectedly reload, taking the firewall offline and disrupting all VPN and network traffic it protects.

Technologies: Cisco Secure Firewall ASA Software, Cisco Secure Firewall Threat Defense Software. Vendors: Cisco.

Quick answers

Is CVE-2026-20101 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20101 being exploited in the wild.
How severe is CVE-2026-20101?: High severity, with a CVSS score of 8.6, published 4 March 2026.
Which products and versions are affected?: Cisco Secure Firewall ASA Software Affected versions available in Cisco advisory; see fixed software section; Cisco Secure Firewall Threat Defense Software Affected versions available in Cisco advisory; see fixed software section.
Is there a fix for CVE-2026-20101?: A patch was published on 2026-03: Software updates available from Cisco Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20101 attacked?: It is attacked over the network.
Am I affected by CVE-2026-20101?: Check whether you run Cisco Secure Firewall ASA Software or Cisco Secure Firewall Threat Defense Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the SAML 2.0 SSO authentication component of Cisco Secure Firewall ASA and FTD software due to insufficient error checking when processing SAML protocol messages. An unauthenticated, remote attacker can exploit this via the network by sending malformed SAML messages to the affected SAML service without requiring any credentials or user interaction. A successful exploit causes the device to reload unexpectedly, resulting in a denial of service condition that may require manual intervention to restore. The CVSS 3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), reflecting the network attack vector, lack of authentication, high availability impact, and scope change. Patches are available from Cisco.

Affected products

Cisco Secure Firewall ASA Software Affected versions available in Cisco advisory; see fixed software section
Cisco Secure Firewall Threat Defense Software Affected versions available in Cisco advisory; see fixed software section

Timeline

2026-03-04: disclosed: Cisco Security Advisory published
2026-03: patched: Software updates available from Cisco

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-m9sx6MbC

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.