CVE Alert: CVE-2026-20336 – Cisco – Cisco Secure Firewall Adaptive Security Appliance (ASA) Software

As part of Cisco’s ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20336 are related to issues concerning improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.

This is a high-impact vulnerability requiring prompt remediation, but current evidence indicates no known exploitation and does not justify emergency priority-one handling.

Successful exploitation could compromise the security boundary itself, allowing an attacker to disrupt traffic, alter security policy or gain access to sensitive traffic and management functions. Firewalls and their management platforms are high-value targets because compromise can enable concealment, interception and follow-on attacks against protected networks. Exploitation is not currently reported publicly, but the complete impact profile warrants close monitoring.

### Most likely attack path

An attacker needs network adjacency, such as access to a shared internal segment, management network or exposed service path; no credentials or user interaction are required, and the attack is described as low complexity. Scope remains unchanged, so the primary impact is on the vulnerable security device or management plane rather than automatic cross-boundary privilege expansion, although a compromised firewall could still facilitate lateral movement operationally.

### Who is most exposed

Organisations with internet-facing or broadly reachable perimeter appliances, shared administration networks, remote-access infrastructure, or centrally managed multi-site estates face the greatest exposure. Devices reachable from untrusted adjacent networks should be prioritised over isolated, tightly filtered deployments.

Review firewall, FMC and management-plane logs for unusual requests, crashes or restarts.

Alert on configuration changes without an approved change record.

Correlate new administrative sessions with unexpected source addresses.

Monitor abnormal policy deployment, failover or traffic-processing events.

Check telemetry for unexplained traffic bypasses or service degradation.

### Mitigation and prioritisation

Apply Cisco’s fixed software release promptly, following its upgrade guidance.

Restrict management and adjacent-network access using ACLs, dedicated administration paths and MFA.

Isolate exposed appliances and disable unnecessary reachable services.

Validate backups, failover behaviour and policy integrity before and after change.

EPSS and KEV status are not supplied; reassess priority when those signals become available.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.