High

Cisco Secure Firewall ASA and Secure FTD IKEv2 Denial of Service Vulnerability

IdentifiersCVE-2026-20014CWE-400

A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated remote attacker with valid VPN user credentials to cause a denial-of-service condition on an affected device. The issue is due to improper processing of IKEv2 packets. An attacker can exploit the vulnerability by sending crafted, authenticated IKEv2 packets to the target device, which can exhaust memory and cause the device to reload. The resulting disruption may also affect the availability of services to other devices elsewhere in the network.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can exhaust memory on the affected Cisco Secure Firewall ASA or Secure FTD device and force a device reload, resulting in denial of service. Because the vulnerable device may provide security and connectivity functions for other systems, the outage can also impact the availability of services to devices elsewhere in the network.

Mitigation

If you can’t patch tonight, do this now.

No workarounds are available according to the provided content. Mitigation is therefore limited to reducing exposure of the vulnerable IKEv2 service where operationally feasible and applying Cisco's software updates.

Remediation

Patch, then assume compromise.

Cisco has released software updates to address this vulnerability. Affected organizations should identify vulnerable Cisco Secure Firewall ASA and Secure FTD deployments using IKEv2 and apply the vendor-provided fixed software versions as described in the relevant Cisco security advisory.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Cisco SystemsAdaptive Security Appliance Softwareoperating_system

Cisco SystemsFirepower Threat Defense Softwareapplication

Cisco SystemsSecure Firewall Asa Softwareapplication

Cisco SystemsSecure Ftd Softwareapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

11 SOURCESView more in app

cisco security centerNews

Mar 4, 2026

Cisco Event Response: March 2026 Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software Security Advisory Bundled Publication

IKEv2 denial of service vulnerability affecting Cisco ASA and Cisco Secure Firewall Threat Defense (FTD).

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity7