CVE-2026-20103 — Allocation of Resources Without Limits or Throttling in Cisco Secure Firewall Adaptive Security Appliance Software

CWE-770 — Allocation of Resources Without Limits or ThrottlingCWE-120 — Classic Buffer OverflowCWE-330 — Use of Insufficiently Random ValuesCWE-401 — Missing Release of Memory after Effective Lifetime4 documents4 sources
Severity
8.6HIGHNVD
EPSS
0.1%
top 78.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Secure Firewall Adaptive Security Appliance SoftwareCisco Secure Firewall Threat Defense Software
Timeline
PublishedMar 4
Latest updateMar 5

Description

A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust device memory resulting in a denial of service (DoS) condition to new Remote Access SSL VPN connections. This does not affect the management interface, though it may become temporarily unresponsive. This vulnerability is due to trusting user input without validati…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitability: 3.9 | Impact: 4.0

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-r8xj-9pfh-x4pw: A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Thr↗2026-03-04
▶
CVEList
CVE-2026-20103: A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Thr↗2026-03-04
▶

📋Vendor Advisories

1
Cisco
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerabilities↗2026-03-05
▶
CVE-2026-20103 — Cisco vulnerability | cvebase