CVE-2026-20135 is a high-severity vulnerability in Cisco Secure Firewall Threat Defense (FTD) Software's TLS 1.3 implementation. It involves improper buffer management that can be triggered by an unauthenticated remote attacker sending crafted TLS 1.3 packets. Successful exploitation causes the LINA process to crash, leading to device reloads and denial of service. This affects numerous specific versions of the software. No known exploits are reported in the wild.
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.
This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
CVE-2026-20352 is a high-severity vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) software. It allows an unauthenticated remote attacker to cause a denial of service (DoS) by sending crafted RADIUS requests. This results in the affected ISE node becoming unavailable, potentially disrupting network access for endpoints in single node deployments until the node recovers.
CVE-2026-76413 is a high-severity vulnerability in Cisco Secure Firewall Management Center (FMC) affecting multiple versions. It involves improper management of the Cisco Adaptive Security Device Manager (ASDM) single sign-on (SSO) token, allowing an unauthenticated remote attacker to log in as the ASDM administrator. Exploitation could enable the attacker to repeatedly lock out legitimate administrators from ASDM.
CVE-2026-20336 is a high-severity vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software involving improper control of a resource through its lifetime. This issue was identified during Cisco's internal security review and affects multiple specific versions of the ASA software. The vulnerability has a CVSS score of 8.8, indicating a significant impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. Cisco has released a software hardening update addressing this and other vulnerabilities.
CVE-2026-20249 is a high-severity vulnerability in the certificate authentication feature of IKEv2 for Cisco Secure Firewall ASA and FTD Software. It arises from a logic error during the certificate authentication phase, allowing an unauthenticated remote attacker to cause the IKEv2 process to crash by presenting a crafted certificate. This results in a denial of service (DoS) condition due to device reloads or process crashes. The vulnerability affects multiple specific versions of Cisco ASA software.
A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to inject arbitrary operating system commands.
This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by saving configuration details that contain malicious values. A successful exploit could allow the attacker to execute arbitrary operating system commands with root privileges. To exploit this vulnerability, the attacker must have valid administrative credentials.
A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote attacker to execute arbitrary commands at the root privilege level.
This vulnerability is due to unsecured deserialization of web-management user-controlled data. An attacker could exploit this vulnerability by authenticating to the device and sending a crafted HTTP payload. A successful exploit could allow the attacker to save the crafted payload and then execute it on the underlying operating system as root.
To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Security Analyst (read-only).
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76409 are related to improper limitation of a pathname issues that are grouped under the Common Weakness Enumeration (CWE) CWE-22.
CVE-2026-20335 is a high-severity vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software involving incorrect calculation issues. These issues were discovered during an internal security review and are categorized under CWE-682. The vulnerability affects multiple specific versions of the ASA software. It has a CVSS 3.1 score of 8.1, indicating high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. Cisco has released a software hardening update addressing these vulnerabilities.
CVE-2026-20295 is a high-severity vulnerability in Cisco Secure Firewall Management Center (FMC) and Cisco Secure FTD Software. It involves improper memory management during the sftunnel TLS connection setup, allowing an unauthenticated remote attacker to exhaust device memory by sending crafted TLS frames. This can cause a denial-of-service (DoS) condition on affected devices.
A vulnerability in Datagram TLS (DTLS) message handling of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software for Cisco Secure Firewall 3100 Series and 4200 Series devices could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to improper resource management when processing certain DTLS messages. An attacker could exploit this vulnerability by sending a crafted stream of DTLS traffic to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
CVE-2026-20176 is a critical command injection vulnerability in Cisco Identity Services Engine (ISE) software. It allows an authenticated attacker with high-privileged administrative credentials to execute arbitrary commands on the underlying operating system. Exploitation involves sending a crafted HTTP request to the affected device. Successful exploitation can lead to system-level access, privilege escalation to root, and in single-node deployments, denial of service by making the node unavailable. This disrupts network access for unauthenticated endpoints until the node is restored.
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software could allow an authenticated, remote attacker to obtain root privileges.
This vulnerability is due to unsecured deserialization of untrusted data over the sftunnel management connection. An attacker could exploit this vulnerability by sending crafted sftunnel remote procedure calls (RPCs). A successful exploit could allow the attacker to gain root privileges on a device that is running Cisco Secure FMC Software and its high-availability peer.
To exploit this vulnerability, the attacker must have valid administrative credentials on a managed Cisco FTD device.
A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device.
This vulnerability is due to insecure deserialization of a user-supplied Java byte stream from a host that is configured in the external database access list. An attacker could exploit this vulnerability by sending a crafted, serialized Java byte stream to a specific TCP port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the device and elevate privileges to root.
Notes:
This vulnerability can be exploited only by an attacker who has control of a host in the external database access list.
If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20237 are related to improper input validation issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-20.
CVE-2026-76423 is a critical authentication bypass vulnerability in the REST API of Cisco Identity Services Engine (ISE) software versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0. It allows an unauthenticated remote attacker to gain administrative access by exploiting insufficient authorization checks on the REST API web service. Successful exploitation enables reading and modifying ISE configuration and identity data with administrative privileges.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20130 are related to improper neutralization of special elements issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20361 are related to SQL injection issues that are grouped under the Common Weakness Enumeration (CWE) CWE-89.