CVE-2026-20120 describes a vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software related to the ACL Object Group Search (OGS) feature. Due to a logic error in how group access control policies are populated when OGS is configured, an unauthenticated remote attacker can bypass access controls by sending traffic that should be blocked. This flaw allows unauthorized access to protected network segments behind the firewall.

An attacker exploiting this vulnerability can bypass configured access controls without authentication, potentially reaching devices in protected networks. The vulnerability does not impact confidentiality but allows integrity violations by bypassing access restrictions. Availability is not affected. The CVSS 3.1 base score is 5.8 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, monitor vendor advisories for updates and consider temporary mitigations if recommended by Cisco.