CVE-2026-20333: Cisco Secure Firewall ASA/FTD/FMC incorrect comparison in security context

CVE-2026-20333 · Severity: high · CVSS 8.8 · Published 2026-09-16

Cisco's Secure Firewall appliances (ASA, FTD, and FMC software) contain multiple security vulnerabilities introduced through incorrect comparison logic in security-sensitive code paths. An authenticated attacker with network access can exploit these flaws to bypass access controls, crash systems, or gain unauthorized privileges, potentially allowing full compromise of network security infrastructure that protects critical business operations.

Technologies: Cisco Secure Firewall Adaptive Security Appliance Software, Cisco Secure Firewall Management Center Software, Cisco Secure Firewall Threat Defense Software. Vendors: Cisco.

Quick answers

Is CVE-2026-20333 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20333 being exploited in the wild.
How severe is CVE-2026-20333?
High severity, with a CVSS score of 8.8, published 16 September 2026.
Which products and versions are affected?
Cisco Secure Firewall Adaptive Security Appliance Software <UNKNOWN>; Cisco Secure Firewall Management Center Software <UNKNOWN>; Cisco Secure Firewall Threat Defense Software <UNKNOWN>.
Is there a fix for CVE-2026-20333?
A patch was published on 2026-09-16: Software updates released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20333 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20333?
Check whether you run Cisco Secure Firewall Adaptive Security Appliance Software, Cisco Secure Firewall Management Center Software or Cisco Secure Firewall Threat Defense Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-20333 specifically addresses incorrect comparison conditions (CWE-697) discovered during Cisco's internal security review and grouped with seven related vulnerabilities across multiple CWE categories (access control, exception handling, data validation, and resource management). The vulnerability requires authentication and network access; the appliances are network-reachable components. An attacker can exploit these flaws to bypass security controls, cause denial of service, or achieve privilege escalation depending on the underlying weakness. Cisco has released software patches and explicitly states there are no workarounds; immediate upgrade is required.

Affected products

  • Cisco Secure Firewall Adaptive Security Appliance Software <UNKNOWN>
  • Cisco Secure Firewall Threat Defense Software <UNKNOWN>
  • Cisco Secure Firewall Management Center Software <UNKNOWN>

Timeline

  • 2026-09-16: disclosed: CVE-2026-20333 published
  • 2026-09-16: patched: Software updates released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.