CVE-2026-20022
Cisco Adaptive Security Appliance Software 9.12.1 … 9.23.1.7
Raw vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:HSummary
CVE-2026-20022 is a medium-severity Use of Out-of-range Pointer Offset (CWE-823) vulnerability in Cisco Adaptive Security Appliance Software. Its CVSS base score is 6.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-7 (Least Functionality) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9479
Vulnerability Data
A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition when OSPF canonicalization debug…
more
is enabled by using the command debug ip ospf canon. This vulnerability is due to insufficient input validation when processing OSPF LSU packets. An attacker could exploit this vulnerability by sending crafted unauthenticated OSPF packets. A successful exploit could allow the attacker to write to memory outside of the packet data, causing the device to reload, resulting in a DoS condition.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables direct DoS via crafted OSPF packet exploitation of input validation flaw (CWE-823) causing device reload.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying vendor patches that eliminate the insufficient input validation flaw in OSPF LSU processing.
Least functionality disables the non-essential debug ip ospf canon command that must be enabled for the memory corruption to occur.
Boundary protection can restrict unauthenticated adjacent OSPF traffic and limit exposure to crafted LSU packets on the link.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect out-of-range pointer offsets before release.
Secure SDLC mandates input validation and bounds checking that can prevent out-of-range pointer offsets.
Application security requirements include memory-safety rules that reduce pointer-offset errors.
Secure architecture principles promote safe pointer handling and memory layout controls.
Secure coding standards directly forbid unsafe pointer arithmetic and require bounds checks.