CVE-2026-20102: Cisco Secure Firewall ASA SAML reflected XSS

CVE-2026-20102 · Severity: medium · CVSS 6.1 · Published 2026-03-04

Cisco Secure Firewall ASA and Threat Defense (FTD) devices that support SAML 2.0 single sign-on (SSO) for remote access VPN are vulnerable to reflected cross-site scripting (XSS) attacks. An attacker can craft a malicious link that, when clicked by a user, injects malicious code into the browser and steals sensitive information or hijack the user's session. This affects firewall administrators and remote workers who authenticate through the SAML SSO feature.

Technologies: Cisco Secure Firewall ASA Software, Cisco Secure Firewall Threat Defense Software. Vendors: Cisco.

Quick answers

Is CVE-2026-20102 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20102 being exploited in the wild.
How severe is CVE-2026-20102?
Medium severity, with a CVSS score of 6.1, published 4 March 2026.
Which products and versions are affected?
Cisco Secure Firewall ASA Software Multiple releases (see Cisco advisory for complete version matrix); Cisco Secure Firewall Threat Defense Software Multiple releases (see Cisco advisory for complete version matrix).
Is there a fix for CVE-2026-20102?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20102 attacked?
It is attacked over the network.
Am I affected by CVE-2026-20102?
Check whether you run Cisco Secure Firewall ASA Software or Cisco Secure Firewall Threat Defense Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a reflected XSS (CWE-79) in the SAML 2.0 SSO feature, caused by insufficient input validation of HTTP parameters. The attack requires an unauthenticated attacker to persuade a user (typically an administrator or remote VPN user) to click a malicious link pointing to the affected device. The vulnerability has a network attack vector and requires user interaction (social engineering) to succeed. A successful exploit allows the attacker to conduct a reflected XSS attack through the SAML SSO endpoint, potentially accessing sensitive browser-based information or session tokens. Cisco has released software updates to address this issue; no workarounds are available.

Affected products

  • Cisco Secure Firewall ASA Software Multiple releases (see Cisco advisory for complete version matrix)
  • Cisco Secure Firewall Threat Defense Software Multiple releases (see Cisco advisory for complete version matrix)

Timeline

  • 2026-03-04: disclosed: Cisco published security advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.