Is CVE-2026-20105 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20105 being exploited in the wild.

How severe is CVE-2026-20105?

High severity, with a CVSS score of 7.7, published 4 March 2026.

Which products and versions are affected?

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software Multiple versions (see Cisco advisory for specific affected releases); Cisco Secure Firewall Threat Defense (FTD) Software Multiple versions (see Cisco advisory for specific affected releases).

Is there a fix for CVE-2026-20105?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-20105 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-20105?

Check whether you run Cisco Secure Firewall Adaptive Security Appliance (ASA) Software or Cisco Secure Firewall Threat Defense (FTD) Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20105: Cisco Secure Firewall ASA and FTD Remote Access SSL VPN denial of service

CVE-2026-20105 · Severity: high · CVSS 7.7 · Published 2026-03-04

Cisco Secure Firewall ASA and FTD appliances used to protect enterprise networks against threats include Remote Access SSL VPN functionality that authenticates remote employees. A flaw in how these devices handle VPN traffic allows a remote attacker to send specially crafted packets that exhaust device memory, forcing the appliance to reload and disrupting network connectivity and remote access for all users until it recovers.

Technologies: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software. Vendors: Cisco.

Quick answers

Is CVE-2026-20105 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20105 being exploited in the wild.
How severe is CVE-2026-20105?: High severity, with a CVSS score of 7.7, published 4 March 2026.
Which products and versions are affected?: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software Multiple versions (see Cisco advisory for specific affected releases); Cisco Secure Firewall Threat Defense (FTD) Software Multiple versions (see Cisco advisory for specific affected releases).
Is there a fix for CVE-2026-20105?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20105 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20105?: Check whether you run Cisco Secure Firewall Adaptive Security Appliance (ASA) Software or Cisco Secure Firewall Threat Defense (FTD) Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Remote Access SSL VPN functionality of Cisco Secure Firewall ASA and FTD software due to insufficient input validation (CWE-120, CWE-330, CWE-401, CWE-770). An authenticated remote attacker with a valid VPN connection can send crafted packets to the SSL VPN server, triggering uncontrolled memory consumption. The attack requires network reachability to the VPN endpoint and a valid VPN authentication, but no further user interaction. Successful exploitation causes the device to reload, resulting in a denial of service condition that may require manual intervention to restore service. Cisco has released software updates to address these vulnerabilities; no workarounds are available.

Affected products

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software Multiple versions (see Cisco advisory for specific affected releases)
Cisco Secure Firewall Threat Defense (FTD) Software Multiple versions (see Cisco advisory for specific affected releases)

Timeline

2026-03-04: disclosed

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-m9sx6MbC

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.