# CVE-2026-20329: Cisco Secure Firewall improper exception handling and input validation

Source: https://junglewise.ai/threats/cve-2026-20329-cisco-secure-firewall-improper-exception-handling-and-input  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-20329 · Severity: critical · CVSS 9.9 · Published 2026-09-16

Cisco Secure Firewall products—which protect enterprise networks by filtering and monitoring traffic—contain multiple critical vulnerabilities in exception handling, input validation, and access control. An authenticated attacker can exploit these flaws to bypass authentication, gain unauthorized access, crash the firewall, or compromise confidentiality and integrity of network traffic. Two vulnerabilities are currently being exploited in the wild.

Technologies: [Cisco Secure Firewall ASA Software](https://junglewise.ai/threats/technologies/secure-firewall-asa-software), [Cisco Secure Firewall Management Center Software](https://junglewise.ai/threats/technologies/secure-firewall-management-center-software), [Cisco Secure Firewall Threat Defense Software](https://junglewise.ai/threats/technologies/firepower-threat-defense-software). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20329 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20329 being exploited in the wild.

**How severe is CVE-2026-20329?** Critical severity, with a CVSS score of 9.9, published 16 September 2026.

**Which products and versions are affected?** Cisco Secure Firewall ASA Software Multiple versions; see vendor advisory for specific fixed releases; Cisco Secure Firewall Management Center Software Multiple versions; see vendor advisory for specific fixed releases; Cisco Secure Firewall Threat Defense Software Multiple versions; see vendor advisory for specific fixed releases.

**Is there a fix for CVE-2026-20329?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20329 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-20329?** Check whether you run Cisco Secure Firewall ASA Software, Cisco Secure Firewall Management Center Software or Cisco Secure Firewall Threat Defense Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This advisory groups eight distinct vulnerabilities across Cisco Secure Firewall ASA, Threat Defense, and Management Center software, categorized by root cause (CWE-703 improper exception handling, CWE-707 improper input validation, CWE-284 access control flaws, and others). The vulnerabilities were discovered during Cisco's internal security review. The primary attack vector is network-based with low attack complexity; exploitation requires low privileges (authentication) and produces high impact on confidentiality, integrity, and availability. Two vulnerabilities in the access control class (CWE-284) affecting the Management Center are confirmed actively exploited; these include static credential and authentication bypass issues. Cisco has released patched software versions; no workarounds are available.

## Affected products

- Cisco Secure Firewall ASA Software Multiple versions; see vendor advisory for specific fixed releases
- Cisco Secure Firewall Threat Defense Software Multiple versions; see vendor advisory for specific fixed releases
- Cisco Secure Firewall Management Center Software Multiple versions; see vendor advisory for specific fixed releases

## Timeline

- 2026-09-16: disclosed: Cisco security advisory published
- exploited: Two vulnerabilities in access control class (CWE-284) confirmed actively exploited in the wild

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN)

## Related threats

- [Cisco Secure Firewall ASA and FTD SSL VPN denial of service](https://junglewise.ai/threats/cve-2026-76418-a-vulnerability-in-the-remote-access-ssl-vpn-service-of-cisco)
- [Cisco Snort 3 GRE detection engine denial of service](https://junglewise.ai/threats/cve-2026-20179-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Secure FMC SQL injection in web management interface](https://junglewise.ai/threats/cve-2026-20344-cisco-secure-fmc-sql-injection-in-web-management-interface)
- [Cisco Secure FMC arbitrary file download in download API](https://junglewise.ai/threats/cve-2026-20342-cisco-secure-fmc-arbitrary-file-download-in-download-api)
- [Cisco Secure Firewall ASA calculation error in security-critical context](https://junglewise.ai/threats/cve-2026-20335-cisco-secure-firewall-asa-calculation-error-in-security-critical)