Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HSummary
CVE-2026-20101 is a high-severity Use of Insufficiently Random Values (CWE-330) vulnerability in Cisco Adaptive Security Appliance Software. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Forge Web Credentials (T1606); ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-12 (Cryptographic Key Establishment and Management) and SC-13 (Cryptographic Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-20101 is a vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software. The issue stems from insufficient error checking when processing SAML messages, which could allow an unauthenticated, remote attacker to cause the affected device to reload unexpectedly, resulting in a denial-of-service (DoS) condition. It is rated with a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) and is associated with CWE-330.
An unauthenticated, remote attacker can exploit this vulnerability by sending crafted SAML messages to the SAML service on the device. A successful exploit causes the device to reload, leading to a DoS condition that disrupts network traffic processing.
The Cisco Security Advisory provides details on mitigation and patches: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-m9sx6MbC.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9440
Vulnerability Data
A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition. This vulnerability…
more
is due to insufficient error checking when processing SAML messages. An attacker could exploit this vulnerability by sending crafted SAML messages to the SAML service. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 8 hardening rules · 4 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
SC-12 requires proper cryptographic key establishment and management, which structurally mandates use of sufficient randomness for key generation.
SC-13 requires selection and implementation of approved cryptographic algorithms and methods, which inherently depend on and enforce sufficiently random values.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce use of cryptographically strong RNGs and catch insufficient randomness during design, coding, and testing.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Cryptographic controls require use of approved, sufficiently random values for keys and nonces.
Security testing can detect weak randomness but does not prescribe the control itself.
Secure SDLC processes include verification steps that can catch insufficient randomness but do not directly specify RNG requirements.
Secure coding standards explicitly prohibit use of weak or predictable random number generators.
Secure authentication mechanisms depend on unpredictable values (nonces, salts, session tokens) to resist guessing.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (3 rules)
- V-248563 The OL 8 SSH server must be configured to use strong entropy. prevents CWE-330
- V-248599 OL 8 must enable the hardware random number generator entropy gatherer service. prevents CWE-330
- V-248600 OL 8 must have the packages required to use the hardware random number generator entropy gatherer service. prevents CWE-330
Oracle Linux 9 (1 rule)
- V-271511 OL 9 must enable the hardware random number generator entropy gatherer service. prevents CWE-330
RHEL 8 (3 rules)
- V-244527 RHEL 8 must have the packages required to use the hardware random number generator entropy gatherer service. prevents CWE-330
- V-230253 RHEL 8 must ensure the SSH server uses strong entropy. prevents CWE-330
- V-230285 RHEL 8 must enable the hardware random number generator entropy gatherer service. prevents CWE-330
RHEL 9 (1 rule)
- V-257782 RHEL 9 must enable the hardware random number generator entropy gatherer service. prevents CWE-330