A vulnerability in the DNS over TCP implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the TCP DNS response handler to unexpectedly restart, causing the device to reload.
This vulnerability is due to a logic error when parsing a DNS query and tracking the size of the incoming buffers. An attacker could exploit this vulnerability by formatting a crafted reply to a DNS query sent from the targeted device. A successful exploit could allow the attacker to cause the device to reload, causing a denial of service (DoS) condition.
Note: The attacker must be able to respond to DNS queries from the device, either by controlling the DNS service or through a machine-in-the-middle attack.
A vulnerability in the endpoint posture status reporting functionality of the guest portal web application of Cisco ISE could allow an unauthenticated, remote attacker to submit forged posture status events into the endpoint posture pipeline.
This vulnerability is due to insufficient authentication on an internal interface that is exposed through the guest portal. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to manipulate the posture status on the affected system.
CVE-2026-20342 is a high-severity vulnerability in Cisco Secure Firewall Management Center (FMC) that allows an authenticated attacker with Security Analyst role privileges to download arbitrary files from the system due to improper input sanitization in a file download API.
A vulnerability in Cisco ISE could allow an authenticated, remote attacker to obtain write access on the underlying operating system of an affected device.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain write access to the underlying operating system.
To exploit this vulnerability, the attacker must have valid administrative credentials.
Note: For CVE-2026-20282, Cisco has assigned a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that it is easy to get to root from the achieved privilege level.
CVE-2026-20323 is a high-severity vulnerability in Cisco Secure Firewall Management Center (FMC) and Cisco Secure FTD Software. It involves improper TLS certificate validation in the sftunnel inter-device communication protocol. An unauthenticated adjacent attacker could impersonate a peer device and gain manager-level (root-equivalent) access by exploiting this flaw. Successful exploitation requires the sftunnel connection to be down or disrupted to allow the attacker to connect with a crafted TLS certificate.
CVE-2026-76412 is a high-severity vulnerability in Cisco Secure Firewall Management Center (FMC) that allows an authenticated remote attacker to elevate privileges to root by exploiting an error in privilege level checks within the remote diagnostics debugger service. Exploitation requires valid user credentials and involves a complex, multistage process.
CVE-2026-20283 is an OS command injection vulnerability in the IPsec Open API endpoint of Cisco Identity Services Engine (ISE) software. It allows an authenticated attacker with administrative credentials to execute arbitrary OS commands. Exploitation requires the node to have multiple network interfaces with an active IPsec tunnel. Cisco rates the security impact as High due to the ease of privilege escalation to root. The CVSS v3.1 base score is 6.5 (medium severity).
CVE-2026-20333 is a high-severity vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software caused by incorrect comparison conditions. It was identified during an internal security review by Cisco, leading to a software hardening release addressing multiple vulnerabilities. The flaw relates to CWE-697, which involves improper comparison logic. The vulnerability affects specific versions of Cisco ASA software and has a CVSS score of 8.8, indicating a significant impact on confidentiality, integrity, and availability.
CVE-2026-76425 is a high-severity SQL injection vulnerability in Cisco Identity Services Engine (ISE) Software APIs. It allows an authenticated attacker with administrative privileges to inject malicious SQL commands due to insufficient validation of input parameters. Exploitation can lead to unauthorized reading of backend database content and server-side request forgery (SSRF) attacks. The affected versions are 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0.
CVE-2026-20334 is a high-severity vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software caused by improper adherence to coding standards related to CWE-710. Cisco conducted an internal security review that identified multiple vulnerabilities, leading to a software hardening release addressing these issues. The vulnerability affects specific versions of the ASA software and has a CVSS score of 8.4, indicating a significant risk. No known exploits are reported in the wild. The vulnerability impacts confidentiality, integrity, and availability with high privileges required and user interaction necessary.
A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks.
This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulnerability by sending crafted input to an affected device. A successful exploit could allow the attacker to view or modify data on the underlying database for the affected device. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
To exploit this vulnerability, the attacker must have valid administrative credentials, have the SXP service enabled, and have at least one SXP connection configured.
CVE-2026-76424 is a high-severity vulnerability in the REST API of Cisco Identity Services Engine (ISE) Software. It allows an authenticated attacker with administrative privileges to upload or copy arbitrary files to the device by exploiting insufficient validation of file paths. Successful exploitation can lead to arbitrary command execution as root on the affected device. The vulnerability affects specific versions 3.1.0 through 3.5.0 of Cisco ISE. No information about available patches or vendor advisories is provided.
CVE-2026-20332 is a critical improper access control vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software. It was identified during an internal security review by Cisco, leading to a software hardening release addressing multiple vulnerabilities. The flaw relates to CWE-284, indicating weaknesses in access control mechanisms. The vulnerability has a high CVSS score of 9.9, reflecting its potential to cause severe confidentiality, integrity, and availability impacts. Multiple specific ASA software versions are affected. No known exploits are reported in the wild at this time.
A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have a valid account on the device with the role of Security Approver, Access Admin, or Network Admin.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain any data from the database, obtain the session credentials of an authenticated Administrator, and take actions with administrative privileges on the affected device.
A vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause high CPU utilization on an affected device, resulting in a denial of service (DoS) condition.
This vulnerability is due to improper rate limiting for syslog message 419002. An attacker could exploit this vulnerability by sending a flood of TCP synchronization (SYN) packets to an affected device. A successful exploit could allow the attacker to cause high CPU utilization, resulting in performance degradation.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20360 are related to information exposure and insecure handling issues that are grouped under the Common Weakness Enumeration (CWE) CWE-200.
A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files and use unbounded disk space.
This vulnerability exists because a critical API lacks authentication. An attacker could exploit this vulnerability by repeatedly invoking the API. A successful exploit could allow the attacker to download sensitive files that should be restricted and consume disk space so the device could become unresponsive, causing a DoS condition.
A vulnerability in the EIGRP implementation in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, adjacent attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
This vulnerability is due to improper resource management when handling EIGRP update messages. An attacker could exploit this vulnerability by sending crafted EIGRP updates at a high rate to an affected device. A successful exploit could allow the attacker to trigger a memory leak that will eventually cause the affected device to reload unexpectedly.
CVE-2026-20247 is a high-severity SQL injection vulnerability in Cisco Identity Services Engine (ISE) Software. It allows an unauthenticated remote attacker to send crafted requests that exploit improper validation of user input, potentially modifying data in the device's underlying database. The affected versions are 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0. No known exploits are reported in the wild. The vulnerability has a CVSS score of 7.5, indicating a significant risk due to its ability to impact data integrity without requiring user interaction or privileges.