CVE-2026-20249: Cisco Secure Firewall IKEv2 certificate authentication denial of service

CVE-2026-20249 · Severity: high · CVSS 8.6 · Published 2026-09-16

Cisco Secure Firewall ASA and FTD devices used to protect enterprise networks can be disrupted by an unauthenticated remote attacker sending a crafted certificate during VPN connection setup. An attacker can crash the IKEv2 process without authentication, causing the firewall to reload and interrupting all network traffic protected by the device until it recovers.

Technologies: Cisco Secure Firewall Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software. Vendors: Cisco.

Quick answers

Is CVE-2026-20249 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20249 being exploited in the wild.
How severe is CVE-2026-20249?
High severity, with a CVSS score of 8.6, published 16 September 2026.
Which products and versions are affected?
Cisco Secure Firewall Adaptive Security Appliance Software 9.16 and earlier (fixed in 9.16.4.103), 9.18.x (fixed in 9.18.4.94), 9.20.x (fixed in 9.20.4.49), 9.22.x (fixed in 9.22.3.26), 9.23.x (fixed in 9.23.1.47), 9.24.x (fixed in 9.24.1.26); Cisco Secure Firewall Threat Defense Software 7.0 and earlier (fixed in 7.0.10), 7.2.x (fixed in 7.2.12), 7.4.x (fixed in 7.4.8), 7.6.x (fixed in 7.6.6), 7.7.x (fixed in 7.7.13), 10.0.x (fixed in 10.0.2), 10.1.x (fixed in 10.1.0).
Is there a fix for CVE-2026-20249?
A patch was published on 2026-09-16: Fixed software releases available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20249 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20249?
Check whether you run Cisco Secure Firewall Adaptive Security Appliance Software or Cisco Secure Firewall Threat Defense Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logic error in the IKEv2 certificate authentication phase allows unauthenticated, remote attackers to cause denial of service. The vulnerability exists in both Cisco Secure Firewall ASA and Threat Defense (FTD) software when IKEv2 VPN with certificate authentication is enabled. An attacker can exploit this by crafting a malicious certificate and attempting to establish an IKEv2 connection, triggering an unhandled condition that crashes the IKEv2 process and causes the device to reload. No user interaction or authentication is required. Cisco has released software updates for all affected versions, and no workarounds are available.

Affected products

  • Cisco Secure Firewall Adaptive Security Appliance Software 9.16 and earlier (fixed in 9.16.4.103), 9.18.x (fixed in 9.18.4.94), 9.20.x (fixed in 9.20.4.49), 9.22.x (fixed in 9.22.3.26), 9.23.x (fixed in 9.23.1.47), 9.24.x (fixed in 9.24.1.26)
  • Cisco Secure Firewall Threat Defense Software 7.0 and earlier (fixed in 7.0.10), 7.2.x (fixed in 7.2.12), 7.4.x (fixed in 7.4.8), 7.6.x (fixed in 7.6.6), 7.7.x (fixed in 7.7.13), 10.0.x (fixed in 10.0.2), 10.1.x (fixed in 10.1.0)

Timeline

  • 2026-09-16: disclosed
  • 2026-09-16: patched: Fixed software releases available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.