CVE-2026-20106 — Missing Release of Memory after Effective Lifetime in Cisco Secure Firewall Adaptive Security Appliance Software

CWE-401 — Missing Release of Memory after Effective LifetimeCWE-120 — Classic Buffer OverflowCWE-330 — Use of Insufficiently Random ValuesCWE-770 — Allocation of Resources Without Limits or Throttling4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.1%
top 80.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Secure Firewall Adaptive Security Appliance SoftwareCisco Secure Firewall Threat Defense Software
Timeline
PublishedMar 4
Latest updateMar 5

Description

A vulnerability in the Remote Access SSL VPN, HTTP management and MUS functionality, of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust device memory resulting in a denial of service (DoS) condition requiring a manual reboot. This vulnerability is due to trusting user input without validation. An attacker could exploit this vulnerability by sending crafted packets to the …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

🔴Vulnerability Details

2
CVEList
CVE-2026-20106: A vulnerability in the Remote Access SSL VPN, HTTP management and MUS functionality, of Cisco Secure Firewall Adaptive Security Appliance (ASA) Softwa↗2026-03-04
▶
GHSA
GHSA-rjp2-r49q-cqxh: A vulnerability in the Remote Access SSL VPN, HTTP management and MUS functionality, of Cisco Secure Firewall Adaptive Security Appliance (ASA) Softwa↗2026-03-04
▶

📋Vendor Advisories

1
Cisco
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerabilities↗2026-03-05
▶
CVE-2026-20106 — Cisco vulnerability | cvebase