CVE-2026-20082

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20082", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.364Z", "datePublished": "2026-03-04T17:22:34.106Z", "dateUpdated": "2026-03-04T20:52:52.679Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-04T17:22:34.106Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause incoming TCP SYN packets to be dropped incorrectly.\r\n\r This vulnerability is due to improper handling of new, incoming TCP connections that are destined to management or data interfaces when the device is under a TCP SYN flood attack. An attacker could exploit this vulnerability by sending a crafted stream of traffic to an affected device. A successful exploit could allow the attacker to prevent all incoming TCP connections to the device from being established, including remote management access, Remote Access VPN (RAVPN) connections, and all network protocols that are TCP-based. This results in a denial of service (DoS) condition for affected features."}], "affected": [{"vendor": "Cisco", "product": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software", "versions": [{"version": "9.20.4.14", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Release of Resource after Effective Lifetime", "type": "cwe", "cweId": "CWE-772"}]}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-dos-FCvLD6vR", "name": "cisco-sa-asa-dos-FCvLD6vR"}], "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-asa-dos-FCvLD6vR", "discovery": "EXTERNAL", "defects": ["CSCwr58661"]}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T20:52:44.973008Z", "id": "CVE-2026-20082", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T20:52:52.679Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20082", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T20:52:44.973008Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T20:52:49.500Z"}}], "cna": {"source": {"defects": ["CSCwr58661"], "advisory": "cisco-sa-asa-dos-FCvLD6vR", "discovery": "EXTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software", "versions": [{"status": "affected", "version": "9.20.4.14"}]}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-dos-FCvLD6vR", "name": "cisco-sa-asa-dos-FCvLD6vR"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause incoming TCP SYN packets to be dropped incorrectly.\r\n\r This vulnerability is due to improper handling of new, incoming TCP connections that are destined to management or data interfaces when the device is under a TCP SYN flood attack. An attacker could exploit this vulnerability by sending a crafted stream of traffic to an affected device. A successful exploit could allow the attacker to prevent all incoming TCP connections to the device from being established, including remote management access, Remote Access VPN (RAVPN) connections, and all network protocols that are TCP-based. This results in a denial of service (DoS) condition for affected features."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-772", "description": "Missing Release of Resource after Effective Lifetime"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-04T17:22:34.106Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20082", "state": "PUBLISHED", "dateUpdated": "2026-03-04T20:52:52.679Z", "dateReserved": "2025-10-08T11:59:15.364Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2026-03-04T17:22:34.106Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software", "vendor": "Cisco", "versions": [{"status": "affected", "version": "9.20.4.14"}]}], "source": "psirt@cisco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*", "matchCriteriaId": "3C406217-1C8A-49CD-8A46-2AD883D21035", "versionEndExcluding": "9.20.4.19", "versionStartIncluding": "9.20.4.14", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause incoming TCP SYN packets to be dropped incorrectly.\r\n\r This vulnerability is due to improper handling of new, incoming TCP connections that are destined to management or data interfaces when the device is under a TCP SYN flood attack. An attacker could exploit this vulnerability by sending a crafted stream of traffic to an affected device. A successful exploit could allow the attacker to prevent all incoming TCP connections to the device from being established, including remote management access, Remote Access VPN (RAVPN) connections, and all network protocols that are TCP-based. This results in a denial of service (DoS) condition for affected features."}, {"lang": "es", "value": "Una vulnerabilidad en el manejo de los l\u00edmites de conexi\u00f3n embrionaria en el software Cisco Secure Firewall Adaptive Security Appliance (ASA) podr\u00eda permitir a un atacante remoto no autenticado causar que los paquetes TCP SYN entrantes sean descartados incorrectamente. Esta vulnerabilidad se debe a un manejo inadecuado de las nuevas conexiones TCP entrantes que est\u00e1n destinadas a interfaces de gesti\u00f3n o de datos cuando el dispositivo est\u00e1 bajo un ataque de inundaci\u00f3n TCP SYN. Un atacante podr\u00eda explotar esta vulnerabilidad enviando un flujo de tr\u00e1fico manipulado a un dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante evitar que se establezcan todas las conexiones TCP entrantes al dispositivo, incluyendo el acceso de gesti\u00f3n remota, las conexiones de VPN de Acceso Remoto (RAVPN) y todos los protocolos de red basados en TCP. Esto resulta en una condici\u00f3n de denegaci\u00f3n de servicio (DoS) para las caracter\u00edsticas afectadas."}], "id": "CVE-2026-20082", "lastModified": "2026-06-17T10:17:02.830", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20082", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T20:52:44.973008Z", "version": "2.0.3"}}]}, "published": "2026-03-04T18:16:24.483", "references": [{"source": "psirt@cisco.com", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-dos-FCvLD6vR"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-772"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "9.20.4.14"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software", "source": "cna", "vendor": "Cisco"}, "product": "adaptive_security_appliance_software", "vendor": "cisco"}], "analysis": {"en": {"generated_at": "2026-04-16T13:23:23.379140+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2011issued patch or firmware update for Cisco ASA software as soon as it becomes available.", "Reduce the maximum number of concurrent embryonic connections or implement traffic shaping to limit the impact of a SYN flood.", "Configure the firewall or upstream devices to detect and block SYN\u2011Flood traffic before it reaches the ASA, such as by enabling SYN flood protection on IDS/IPS or load balancers."], "summary": {"action": "Apply Patch", "impact": "Denial of Service (DoS) affecting all TCP connections"}, "threat_synthesis": {"affected_systems": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software is impacted. No specific vulnerable versions are listed in the advisory; all versions present in the product line should be considered potentially affected unless otherwise specified by Cisco.", "description_and_impact": "A flaw in the way Cisco Secure Firewall Adaptive Security Appliance (ASA) Software limits embryonic connections can cause the device to drop legitimate incoming TCP SYN packets when under attack. An unauthenticated attacker may craft traffic that triggers this behavior, which in turn prevents establishment of any TCP connection\u2014including remote management access, Remote Access VPN, and other TCP\u2011based protocols\u2014resulting in a denial of service. (CWE\u2011772).", "risk_and_exploitability": "The CVSS score of 8.6 indicates high severity. The EPSS score is below 1\u202f%, reflecting a low predicted exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw can be triggered remotely by sending crafted TCP traffic, the likely attack vector is over the network. Successful exploitation requires only unauthenticated network access and results in a service outage for all TCP\u2011based services on the device."}}}}, "created": "2026-03-05T09:06:25.587313+00:00", "title": "DoS via TCP SYN mismanagement in Cisco ASA", "updated": "2026-04-16T13:30:16.051031+00:00", "vendors": ["cisco", "cisco$PRODUCT$adaptive_security_appliance_software"]}