CVE-2026-20062 is a vulnerability in the command-line interface (CLI) of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software when operating in multiple context mode. The flaw arises from incorrect execution-assigned permissions related to Secure Copy Protocol (SCP) operations when the CiscoSSH stack is enabled. Specifically, an attacker who has authenticated with administrative privileges in a non-admin context can issue specially crafted SCP copy commands that allow them to copy files to or from other contexts, including the admin and system contexts. This occurs because the access controls for SCP operations do not properly isolate file operations between contexts. Although the attacker cannot list or enumerate files in other contexts, they can read, create, or overwrite files if they know the exact file paths. The vulnerability does not allow direct disruption of service availability for other contexts. Exploitation requires local authenticated access with administrative privileges in at least one non-admin context, increasing the attack complexity. The vulnerability affects a wide range of ASA software versions from 9.17.1 to 9.23.1.3, indicating a long-standing issue across multiple releases. Cisco has assigned a CVSS v3.1 score of 7.2 (high severity), reflecting the significant confidentiality and integrity impacts, though with high attack complexity and requiring privileges. No public exploits have been reported so far. The vulnerability highlights the risks of multi-context environments where improper isolation can lead to cross-context file access.

The vulnerability poses a significant risk to organizations deploying Cisco ASA in multiple context mode, especially those relying on strict separation between contexts for security. An attacker with administrative access in one context can compromise the confidentiality and integrity of other contexts by reading or modifying sensitive configuration files or system files. This could lead to unauthorized disclosure of sensitive information, unauthorized configuration changes, or persistence mechanisms implanted in other contexts. Although availability is not directly impacted, the integrity compromise could indirectly affect firewall policies or system behavior, potentially weakening overall network security. Given the widespread use of Cisco ASA devices in enterprise and service provider networks worldwide, exploitation could facilitate lateral movement, privilege escalation, or data exfiltration within segmented environments. The requirement for local authenticated access with administrative privileges in a non-admin context limits the attack surface but does not eliminate risk, especially in environments where administrative credentials are shared or compromised. The inability to enumerate files increases attack complexity but does not prevent targeted attacks if file paths are known or guessed. The vulnerability could be leveraged in insider threat scenarios or post-compromise stages of an attack chain.

Organizations should immediately verify if their Cisco ASA devices are running affected software versions in multiple context mode and have the CiscoSSH stack enabled. The primary mitigation is to apply Cisco's security patches or software updates that address this vulnerability once available. Until patches are deployed, administrators should restrict SCP access and usage to trusted personnel only and consider disabling SCP operations in non-admin contexts if feasible. Implement strict administrative credential management and monitoring to prevent unauthorized access to any context. Employ network segmentation and access controls to limit local access to ASA devices. Audit and monitor SCP command usage and file access logs for suspicious activity. Educate administrators about the risks of cross-context file operations and enforce the principle of least privilege for context administrators. Consider using alternative secure file transfer methods that enforce proper context isolation. Regularly review and update firewall configurations to detect unauthorized changes potentially resulting from exploitation.