CVE-2026-20120: Cisco Secure Firewall ASA/FTD access control bypass in OGS

CVE-2026-20120 · Severity: medium · CVSS 5.8 · Published 2026-09-16

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) are widely deployed firewalls used to protect corporate networks and enforce access policies. A logic error in their Object Group Search (OGS) feature for access control lists could allow an attacker to send traffic that should be blocked, bypassing firewall rules and reaching protected internal systems without authentication.

Technologies: Cisco Secure Firewall Adaptive Security Appliance, Cisco Secure Firewall Threat Defense. Vendors: Cisco.

Quick answers

Is CVE-2026-20120 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20120 being exploited in the wild.
How severe is CVE-2026-20120?
Medium severity, with a CVSS score of 5.8, published 16 September 2026.
Which products and versions are affected?
Cisco Secure Firewall Adaptive Security Appliance 9.22, 9.23, 9.24 (with OGS configured); Cisco Secure Firewall Threat Defense Multiple releases with OGS configured.
Is there a fix for CVE-2026-20120?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20120 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20120?
Check whether you run Cisco Secure Firewall Adaptive Security Appliance or Cisco Secure Firewall Threat Defense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability stems from a logic error in how the ASA and FTD populate group access control policies (ACPs) when Object Group Search (OGS) is configured. The issue is classified as an improper access control (CWE-284). An unauthenticated, remote attacker can exploit this by sending traffic crafted to bypass the ACL checks, requiring only network reachability to the firewall device. A successful exploit allows complete circumvention of configured access controls, enabling an attacker to reach systems and networks that should be protected. Cisco has released patched software versions; no workarounds are available.

Affected products

  • Cisco Secure Firewall Adaptive Security Appliance 9.22, 9.23, 9.24 (with OGS configured)
  • Cisco Secure Firewall Threat Defense Multiple releases with OGS configured

Timeline

  • 2026-09-16: disclosed: Cisco Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.