High

Cisco Secure Firewall ASA and FTD Remote Access SSL VPN Authenticated Memory Exhaustion DoS

IdentifiersCVE-2026-20105CWE-20

CVE-2026-20105 is a denial-of-service vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. According to the provided content, the flaw is caused by trusting user input without proper validation. An authenticated remote attacker with a valid VPN connection can send crafted packets to the Remote Access SSL VPN server and trigger memory exhaustion on the device. Successful exploitation can force the device to reload, causing a denial-of-service condition. The issue does not affect the management or MUS interfaces.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an authenticated remote attacker with valid SSL VPN access to exhaust device memory and cause the affected ASA or FTD device to reload. The resulting impact is denial of service against the Remote Access SSL VPN service and potentially broader firewall availability during the reload/recovery window. No evidence is provided in the supplied content of confidentiality or integrity impact; the stated effect is availability loss.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure of the Remote Access SSL VPN service to only trusted users and networks, restrict or disable SSL VPN access where operationally feasible, and monitor for abnormal VPN traffic patterns or repeated crafted-packet activity that could indicate exploitation attempts. Because exploitation requires valid VPN credentials and an active VPN connection, tightening VPN access controls and credential hygiene may reduce risk. The provided content does not specify any Cisco-endorsed workaround, so specific vendor mitigation guidance is currently not available here.

Remediation

Patch, then assume compromise.

Apply the Cisco software updates or fixed releases provided in Cisco's advisory for CVE-2026-20105 / the ASA and FTD Remote Access SSL VPN DoS advisory. The provided content does not include exact fixed version numbers, so that information is currently not available here.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Cisco SystemsAdaptive Security Appliance Softwareoperating_system

Cisco SystemsFirepower Threat Defense Softwareapplication

Cisco SystemsSecure Firewall Adaptive Security Applianceapplication

Cisco SystemsSecure Firewall Asa Softwareapplication

Cisco SystemsSecure Firewall Management Center Softwareapplication

Cisco SystemsSecure Firewall Threat Defense Softwareapplication

Cisco SystemsSecure Ftd Softwareapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

10 SOURCESView more in app

cisco security centerNews

Mar 4, 2026

Cisco Event Response: March 2026 Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software Security Advisory Bundled Publication

Denial of service vulnerability affecting Cisco ASA and Cisco Secure Firewall Threat Defense (FTD) Remote Access SSL VPN.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-20105

NVD

nvd.nist.gov/vuln/detail/CVE-2026-20105

MITRE CWE · CWE-20

cwe.mitre.org

Vendor Advisory

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-m9sx6MbC