Cyber Resilience

CVE-2026-20070

XSS in Cisco Adaptive Security Appliance Software 9.12.1 … 9.23.1.7

Published
04 March 2026
Modified
04 May 2026
Patch / advisory
CVSS Score v3.1 6.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score 0.0026 18th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-20070 is a medium-severity Basic XSS (CWE-80) vulnerability in Cisco Adaptive Security Appliance Software. Its CVSS base score is 6.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SC-7 (Boundary Protection) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A vulnerability in the VPN web services component of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a…

more

browser that is accessing an affected device.  This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by persuading a user to follow a link to a malicious website that is designed to submit malicious input to the affected application. A successful exploit could allow the attacker to execute arbitrary HTML or script code in the browser in the context of the VPN web server.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

XSS in public-facing VPN web services directly enables exploitation of the application via malicious input delivery (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-20073Same product: Cisco Adaptive Security Appliance Software
CVE-2024-20382Same product: Cisco Adaptive Security Appliance Software
CVE-2025-20333Same product: Cisco Adaptive Security Appliance Software
CVE-2025-20362Same product: Cisco Adaptive Security Appliance Software
CVE-2018-0296Same product: Cisco Adaptive Security Appliance Software
CVE-2024-20494Same product: Cisco Adaptive Security Appliance Software
CVE-2024-20384Same product: Cisco Adaptive Security Appliance Software
CVE-2020-3580Same product: Cisco Adaptive Security Appliance Software
CVE-2024-20353Same product: Cisco Adaptive Security Appliance Software
CVE-2024-20355Same product: Cisco Adaptive Security Appliance Software

Affected Assets

cisco
adaptive security appliance software
9.12.1, 9.12.1.2, 9.12.1.3, 9.12.2, 9.12.2.1
cisco
firepower threat defense
6.4.0, 6.4.0.1, 6.4.0.10, 6.4.0.11, 6.4.0.12

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SC-7 Boundary Protection
  • SI-3 Malicious Code Protection
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.2.1
  • V1.3.1
  • V1.3.3
  • V1.3.4

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of user-supplied HTTP input to the VPN web services, blocking the unsanitized data that enables the CWE-80 XSS flaw.

prevent

Boundary-protection mechanisms (e.g., WAF rules or HTTP filtering at the firewall perimeter) can inspect and drop malicious script payloads targeting the ASA/FTD VPN portal.

prevent

Malicious-code protections on the device or client browser can detect and neutralize injected scripts delivered via the crafted link described in the CVE.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require output encoding and input validation that prevent basic XSS.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development catches unneutralized script tags before release.

prevents

Secure SDLC mandates input validation and output encoding that directly prevent basic XSS.

prevents

Application security requirements explicitly call for neutralization of script-related HTML tags.

prevents

Secure coding standards require proper escaping of <, >, & to block XSS.

none

Web filtering can block some reflected XSS payloads at the network edge.

References