Cyber Resilience

CVE-2026-20349

Cisco Adaptive Security Appliance Software 9.16.1 … 9.24.1.9

CISA KEVActive ExploitationEUVD Exploited
Published
11 August 2026
Modified
16 September 2026
KEV Added
11 August 2026
Patch / advisory
View advisory
CVSS Score v3.1 8.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EPSS Score 0.022 82th percentile
Risk Priority 88 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-20349 is a high-severity Heap Inspection (CWE-244) vulnerability in Cisco Adaptive Security Appliance Software. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked in the top 18% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified map to SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting…

more

in a denial of service (DoS) condition.  This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

CWE(s)
CWE-244
KEV Date Added
11 August 2026

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003 OS Credential Dumping Credential Access
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.
attack.mitre.org →
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-20039Same product: Cisco Adaptive Security Appliance Software
CVE-2020-3259Same product: Cisco Adaptive Security Appliance Softwareboth on KEV
CVE-2024-20353Same product: Cisco Adaptive Security Appliance Softwareboth on KEV
CVE-2025-20362Same product: Cisco Adaptive Security Appliance Softwareboth on KEV
CVE-2023-20269Same product: Cisco Adaptive Security Appliance Softwareboth on KEV
CVE-2024-20359Same product: Cisco Adaptive Security Appliance Softwareboth on KEV
CVE-2024-20481Same product: Cisco Adaptive Security Appliance Softwareboth on KEV
CVE-2020-3580Same product: Cisco Adaptive Security Appliance Softwareboth on KEV
CVE-2025-20333Same product: Cisco Adaptive Security Appliance Softwareboth on KEV
CVE-2023-20070Same product: Cisco Secure Firewall Threat Defense

Affected Assets

cisco
adaptive security appliance software
9.16.1, 9.16.1.28, 9.16.2, 9.16.2.11, 9.16.2.13
cisco
secure firewall threat defense
10.0.0, 10.0.2, 7.0.0, 7.0.0.1, 7.0.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-4 Information in Shared System Resources good match

SC-4 requires mechanisms that stop unintended transfer of sensitive data through shared resources such as heap memory reused after realloc.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-10 partial match
prevents

Explicit example of removing confidential data from process memory directly prevents heap inspection exposure.

PR.PS-06 partial match
prevents

Secure SDLC practices encompass proper sensitive-memory handling but fixing this single CWE does not achieve the control.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.10 Information deletion partial match
prevents

Explicitly requires secure deletion of sensitive data, directly addressing improper heap clearing.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC processes can incorporate memory-safety requirements but do not specifically mandate heap clearing.

A.8.28 Secure coding partial match
prevents

Mandates secure coding practices that include proper memory sanitization before release.

References