CVE-2026-20039
Cisco Adaptive Security Appliance Software 9.12.1 – 9.16.4.84
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HSummary
CVE-2026-20039 is a high-severity Heap Inspection (CWE-244) vulnerability in Cisco Adaptive Security Appliance Software. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 29th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-20039 is a vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. It stems from ineffective memory management, which could allow an unauthenticated, remote attacker to trigger a denial-of-service (DoS) condition. The issue has a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) and is associated with CWE-244 (Improper Clearing of Heap Memory Before Release).
An unauthenticated, remote attacker can exploit this vulnerability by sending a large number of crafted HTTP requests to an affected device. Successful exploitation would cause the device to reload, resulting in a DoS condition that disrupts network traffic processing until the device recovers.
The Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-SpOFF2Re provides details on affected software versions, workarounds, and available patches for mitigation. Security practitioners should review the advisory for fixed releases and apply updates promptly to exposed VPN interfaces.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9434
Vulnerability Data
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an…
more
affected device. This vulnerability is due to ineffective memory management of the VPN web server. An attacker could exploit this vulnerability by sending a large number of crafted HTTP requests to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-4 requires mechanisms that stop unintended transfer of sensitive data through shared resources such as heap memory reused after realloc.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Explicitly requires secure deletion of sensitive data, directly addressing improper heap clearing.
Secure SDLC processes can incorporate memory-safety requirements but do not specifically mandate heap clearing.
Mandates secure coding practices that include proper memory sanitization before release.
Secure architecture principles may reduce exposure but do not prescribe explicit heap-clearing techniques.