CVE-2026-20062
Raw vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:NSummary
CVE-2026-20062 is a high-severity Incorrect Execution-Assigned Permissions (CWE-279) vulnerability in Cisco Secure Firewall (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique File and Directory Permissions Modification (T1222); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-20062 is a vulnerability in the command-line interface (CLI) of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software operating in multiple context mode. It stems from improper access controls for Secure Copy Protocol (SCP) operations when the CiscoSSH stack is enabled, potentially allowing unauthorized file access across contexts. This issue is classified under CWE-279 (Incorrect Default Permissions) with a CVSS v3.1 base score of 7.2 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N).
An authenticated, local attacker with administrative privileges in a non-administrative context could exploit this vulnerability by authenticating to that context and issuing crafted SCP copy commands. Successful exploitation enables the attacker to read, create, or overwrite sensitive files belonging to other contexts, including the admin and system contexts. However, the attacker cannot directly impact service availability in those contexts, cannot list or enumerate files from other contexts, and must know the exact file path, which adds complexity to the attack.
For mitigation details, refer to the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-scpcxt-filecpy-rgeP73nE.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9437
Vulnerability Data
A vulnerability in the CLI of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software in multiple context mode could allow an authenticated, local attacker with administrative privileges in one context to copy files to or from another context, including configuration…
more
files. This vulnerability is due to improper access controls for Secure Copy Protocol (SCP) operations when the CiscoSSH stack is enabled. An attacker could exploit this vulnerability by authenticating to a non-admin context of the device and issuing crafted SCP copy commands in that non-admin context. A successful exploit could allow the attacker to read, create, or overwrite sensitive files that belong to another context, including the admin and system contexts. The attacker cannot directly impact the availability of services pertaining to other contexts. To exploit this vulnerability, the attacker must have valid administrative credentials for a non-admin context. Note: An attacker cannot list or enumerate files from another context and would need to know the exact file path, which increases the complexity of a successful attack.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Enforcing approved authorizations structurally stops the runtime assignment of permissions that violate user intent.
Requiring least privilege limits the permissions the executing code is allowed to assign.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Restricting privileged utility programs reduces the chance that such tools will incorrectly alter object permissions.
Privileged access rights management directly constrains the permissions a process may assign at runtime.
Secure coding practices can prevent the coding error that leads to incorrect permission assignment.
Information access restriction policies limit the permissions that executing code can grant or modify.
Change-management procedures can catch permission-setting mistakes before they reach production.