CVE-2026-20222: Cisco Secure Firewall ASA and FTD EIGRP denial of service

CVE-2026-20222 · Severity: high · CVSS 7.4 · Published 2026-09-16

Cisco's Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) are network security devices that protect enterprise networks. A vulnerability in their EIGRP routing protocol implementation allows an unauthenticated attacker on the adjacent network to crash the firewall by sending malicious routing updates, causing a complete service outage until the device restarts.

Technologies: Cisco Secure Firewall Adaptive Security Appliance (Asa), Cisco Secure Firewall Threat Defense (FTD). Vendors: Cisco.

Quick answers

Is CVE-2026-20222 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20222 being exploited in the wild.
How severe is CVE-2026-20222?
High severity, with a CVSS score of 7.4, published 16 September 2026.
Which products and versions are affected?
Cisco Secure Firewall Adaptive Security Appliance (Asa) 9.20, 9.22, 9.23, 9.24 (see advisory for specific fixed versions); Cisco Secure Firewall Threat Defense (FTD) 7.4 and later (specific fixed versions in advisory).
Is there a fix for CVE-2026-20222?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20222 attacked?
It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-20222?
Check whether you run Cisco Secure Firewall Adaptive Security Appliance (Asa) or Cisco Secure Firewall Threat Defense (FTD) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A memory leak vulnerability (CWE-401) exists in the EIGRP update message handler in Cisco Secure Firewall ASA and FTD software. An unauthenticated, adjacent attacker can exploit this by sending crafted EIGRP update messages at high rates to an affected device with EIGRP enabled. The improper resource management causes memory exhaustion, triggering an unexpected device reload and denial of service. The vulnerability requires network adjacency but no authentication, and affects multiple ASA and FTD releases. Cisco has released patched software versions for affected branches (9.20, 9.22, 9.23, 9.24).

Affected products

  • Cisco Secure Firewall Adaptive Security Appliance (ASA) 9.20, 9.22, 9.23, 9.24 (see advisory for specific fixed versions)
  • Cisco Secure Firewall Threat Defense (FTD) 7.4 and later (specific fixed versions in advisory)

Timeline

  • 2026-09-16: disclosed: Cisco Security Advisory published
  • 2026-09-18: advisory: Advisory updated (version 1.1 final)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.