CVE-2026-20006: Cisco Secure Firewall Threat Defense (FTD) Software · Error Handling
Affects Cisco Secure Firewall Threat Defense (FTD) SoftwareSource CVE Database V5
Not known to be exploited · CVSS 5.8 Medium.
Data as of 30 Oct 2026, 06:59 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 33% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 4 Mar 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| CiscoCisco Secure Firewall Threat Defense (FTD) Software | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2026-20006, organizations should: 1) Apply the latest Cisco Secure Firewall Threat Defense software updates and patches as soon as they become available, ensuring affected versions are upgraded to fixed releases. 2) Where immediate patching is not feasible, implement network-level protections such as rate limiting or filtering of suspicious TLS traffic to reduce exposure to crafted packets targeting the Snort 3 engine. 3) Monitor firewall logs and system health metrics for signs of unexpected Snort 3 restarts or anomalous TLS traffic patterns that could indicate exploitation attempts. 4) Consider deploying TLS 1.3 exclusively or prioritizing its use, as this version is not affected by the vulnerability. 5) Employ defense-in-depth strategies by complementing Cisco FTD with additional security controls to detect and respond to network anomalies during potential DoS events. 6) Engage with Cisco support and subscribe to security advisories to stay informed about patches and mitigation guidance. 7) Conduct regular vulnerability assessments and penetration testing to verify the effectiveness of applied mitigations and detect any residual risks. These targeted actions go beyond generic advice by focusing on immediate patching, traffic filtering, monitoring, and leveraging unaffected TLS versions to reduce attack surface.
Description
A vulnerability in the TLS cryptography functionality of the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to unexpectedly restart, resulting in a denial of service (DoS) condition. This vulnerability is due to improper implementation of the TLS protocol. An attacker could exploit this vulnerability by sending a crafted TLS packet to an affected system. A successful exploit could allow the attacker to cause a device that is running Cisco Secure FTD Software to drop network traffic, resulting in a DoS condition. Note: TLS 1.3 is not affected by this vulnerability.