Cyber Resilience

CVE-2026-20106

Cisco Adaptive Security Appliance Software 9.12.1 – 9.16.4.85

Published
04 March 2026
Modified
16 April 2026
Patch / advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0032 24th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-20106 is a medium-severity Missing Release of Memory after Effective Lifetime (CWE-401) vulnerability in Cisco Adaptive Security Appliance Software. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A vulnerability in the Remote Access SSL VPN, HTTP management and MUS functionality, of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust device memory resulting…

more

in a denial of service (DoS) condition requiring a manual reboot. This vulnerability is due to trusting user input without validation. An attacker could exploit this vulnerability by sending crafted packets to the Remote Access SSL VPN server. A successful exploit could allow the attacker to cause the device to stop responding, resulting in a DoS condition.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Remote unauthenticated exploitation of public-facing VPN/management service (T1190) via crafted input to trigger memory exhaustion DoS (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-20013Same product: Cisco Adaptive Security Appliance Software
CVE-2026-20021Same product: Cisco Adaptive Security Appliance Software
CVE-2026-20014Same product: Cisco Adaptive Security Appliance Software
CVE-2026-20105Same product: Cisco Adaptive Security Appliance Software
CVE-2026-20015Same product: Cisco Adaptive Security Appliance Software
CVE-2026-20039Same product: Cisco Adaptive Security Appliance Software
CVE-2026-20103Same product: Cisco Adaptive Security Appliance Software
CVE-2026-20025Same product: Cisco Adaptive Security Appliance Software
CVE-2026-20022Same product: Cisco Adaptive Security Appliance Software
CVE-2026-20101Same product: Cisco Adaptive Security Appliance Software

Affected Assets

cisco
adaptive security appliance software
9.12.1 — 9.16.4.85 · 9.17.1 — 9.18.4.66 · 9.19.1 — 9.20.4
cisco
firepower threat defense software
6.4.0 — 7.0.9 · 7.1.0 — 7.2.11 · 7.3.0 — 7.4.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SC-5 Denial-of-service Protection
  • SC-7 Boundary Protection
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of all input to the SSL VPN and management interfaces, preventing the unvalidated crafted packets that trigger the memory leak (CWE-401).

prevent

Mandates mechanisms to protect against or limit DoS conditions caused by resource exhaustion from remote traffic to the VPN service.

prevent

Enforces boundary protections and traffic filtering on the exposed Remote Access SSL VPN and HTTP management interfaces to reduce attack surface.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly enforce proper memory allocation/deallocation via coding standards, reviews, and tooling.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development can detect unreleased memory, providing partial coverage of the weakness.

prevents

Secure development life cycle mandates memory-management practices that reduce missing-release defects.

prevents

Application security requirements can specify explicit memory-release rules, partially mitigating the weakness.

prevents

Secure system architecture and engineering principles include resource-management guidelines that address memory leaks.

prevents

Secure coding standards directly require proper allocation/deallocation, covering most of this weakness.

detects

Capacity management may detect memory exhaustion symptoms but does not prevent the coding flaw.

References