CVE-2026-20329

This is a mistake in how the software handles unusual situations. Think of a secure building whose control room can be pushed into an unsafe state by someone with limited access: the result can be control over the building's locks, records, and operations.

This matters to you if you run cisco secure firewall adaptive security appliance (asa) software, cisco secure firewall threat defense (ftd) software, or cisco secure firewall management center (fmc). It is especially important to review systems where users with limited administrator access can reach the firewall or its management interface.

A public exploit is available, giving attackers a known way to target this issue. Treat this as a red-priority incident: reduce access to the affected systems now and prepare to install Cisco's fix when it becomes available.

Confirm exposure by identifying all ASA, FTD, and FMC deployments; record their software versions, enabled management interfaces, administrator accounts, and the networks that can reach them. The available findings do not provide affected-version ranges or fixed versions, so validate each deployment against Cisco's CVE-2026-20329 advisory when it is published or updated.

No target fixed release or branch-specific upgrade path is available in the findings. Do not assume that a routine update contains the correction; obtain Cisco's stated fixed version for each supported branch, review its release notes for upgrade requirements or breaking changes, and test the upgrade on a representative system where practical.

Until a patch is available, allow management access only from a dedicated trusted administration network or private access path, remove unneeded privileged accounts, and apply least privilege to remaining accounts. Review authentication, configuration-change, export, and system-event logs for unexpected activity; preserve relevant logs and engage Cisco support or incident response if suspicious changes are found. CISA has not listed this CVE in KEV, so no CISA remediation due date applies.

Severity is CVSS 9.9 (Critical): CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The reported weakness is CWE-703, improper handling of exceptional conditions. The vector is network-based, requires low privileges, requires no user interaction, and has scope change with high confidentiality, integrity, and availability impact. A public exploit is available; exploit maturity is therefore public/weaponized. CISA KEV does not list this CVE. EPSS is 0.4% (38th percentile) and flat; this is a prediction rather than evidence of confirmed exploitation.