CVE-2026-20101

A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition. This vulnerability is due to insufficient error checking when processing SAML messages. An attacker could exploit this vulnerability by sending crafted SAML messages to the SAML service. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-m9sx6MbC	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:cisco:adaptive_security_appliance_software::::::::
	cpe:2.3:o:cisco:adaptive_security_appliance_software::::::::
	cpe:2.3:o:cisco:adaptive_security_appliance_software::::::::
	cpe:2.3:o:cisco:adaptive_security_appliance_software::::::::
	cpe:2.3:o:cisco:adaptive_security_appliance_software::::::::

Configuration 2 (hide)

OR	cpe:2.3:a:cisco:secure_firewall_threat_defense::::::::
	cpe:2.3:a:cisco:secure_firewall_threat_defense::::::::
	cpe:2.3:a:cisco:secure_firewall_threat_defense::::::::
	cpe:2.3:a:cisco:secure_firewall_threat_defense::::::::
	cpe:2.3:a:cisco:secure_firewall_threat_defense::::::::

History

No history.

Information

Published : 2026-03-04 18:16

Updated : 2026-08-11 19:40

NVD link : CVE-2026-20101

Mitre link : CVE-2026-20101

CVE.ORG link : CVE-2026-20101

JSON object : View

Products Affected

cisco

secure_firewall_threat_defense
adaptive_security_appliance_software

CWE

CWE-330

Use of Insufficiently Random Values

{"id": "CVE-2026-20101", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20101", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-05T15:33:49.065833Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Cisco", "product": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software", "versions": [{"status": "affected", "version": "9.12.1"}, {"status": "affected", "version": "9.12.1.2"}, {"status": "affected", "version": "9.12.1.3"}, {"status": "affected", "version": "9.12.2"}, {"status": "affected", "version": "9.12.2.4"}, {"status": "affected", "version": "9.12.2.5"}, {"status": "affected", "version": "9.12.2.9"}, {"status": "affected", "version": "9.12.3"}, {"status": "affected", "version": "9.12.3.2"}, {"status": "affected", "version": "9.12.3.7"}, {"status": "affected", "version": "9.12.4"}, {"status": "affected", "version": "9.12.3.12"}, {"status": "affected", "version": "9.12.3.9"}, {"status": "affected", "version": "9.12.2.1"}, {"status": "affected", "version": "9.12.4.2"}, {"status": "affected", "version": "9.12.4.4"}, {"status": "affected", "version": "9.12.4.7"}, {"status": "affected", "version": "9.12.4.10"}, {"status": "affected", "version": "9.12.4.13"}, {"status": "affected", "version": "9.12.4.8"}, {"status": "affected", "version": "9.12.4.18"}, {"status": "affected", "version": "9.12.4.24"}, {"status": "affected", "version": "9.12.4.26"}, {"status": "affected", "version": "9.12.4.29"}, {"status": "affected", "version": "9.12.4.30"}, {"status": "affected", "version": "9.12.4.35"}, {"status": "affected", "version": "9.12.4.37"}, {"status": "affected", "version": "9.12.4.38"}, {"status": "affected", "version": "9.12.4.39"}, {"status": "affected", "version": "9.12.4.40"}, {"status": "affected", "version": "9.12.4.41"}, {"status": "affected", "version": "9.12.4.47"}, {"status": "affected", "version": "9.12.4.48"}, {"status": "affected", "version": "9.12.4.50"}, {"status": "affected", "version": "9.12.4.52"}, {"status": "affected", "version": "9.12.4.54"}, {"status": "affected", "version": "9.12.4.55"}, {"status": "affected", "version": "9.12.4.56"}, {"status": "affected", "version": "9.12.4.58"}, {"status": "affected", "version": "9.12.4.62"}, {"status": "affected", "version": "9.12.4.65"}, {"status": "affected", "version": "9.12.4.67"}, {"status": "affected", "version": "9.16.1"}, {"status": "affected", "version": "9.16.1.28"}, {"status": "affected", "version": "9.16.2"}, {"status": "affected", "version": "9.16.2.3"}, {"status": "affected", "version": "9.16.2.7"}, {"status": "affected", "version": "9.16.2.11"}, {"status": "affected", "version": "9.16.2.13"}, {"status": "affected", "version": "9.16.2.14"}, {"status": "affected", "version": "9.16.3"}, {"status": "affected", "version": "9.16.3.3"}, {"status": "affected", "version": "9.16.3.14"}, {"status": "affected", "version": "9.16.3.15"}, {"status": "affected", "version": "9.16.3.19"}, {"status": "affected", "version": "9.16.3.23"}, {"status": "affected", "version": "9.16.4"}, {"status": "affected", "version": "9.16.4.9"}, {"status": "affected", "version": "9.16.4.14"}, {"status": "affected", "version": "9.16.4.19"}, {"status": "affected", "version": "9.16.4.27"}, {"status": "affected", "version": "9.16.4.38"}, {"status": "affected", "version": "9.16.4.39"}, {"status": "affected", "version": "9.16.4.42"}, {"status": "affected", "version": "9.16.4.48"}, {"status": "affected", "version": "9.16.4.55"}, {"status": "affected", "version": "9.16.4.57"}, {"status": "affected", "version": "9.16.4.61"}, {"status": "affected", "version": "9.16.4.62"}, {"status": "affected", "version": "9.16.4.67"}, {"status": "affected", "version": "9.16.4.70"}, {"status": "affected", "version": "9.16.4.71"}, {"status": "affected", "version": "9.16.4.76"}, {"status": "affected", "version": "9.16.4.82"}, {"status": "affected", "version": "9.16.4.84"}, {"status": "affected", "version": "9.17.1"}, {"status": "affected", "version": "9.17.1.7"}, {"status": "affected", "version": "9.17.1.9"}, {"status": "affected", "version": "9.17.1.10"}, {"status": "affected", "version": "9.17.1.11"}, {"status": "affected", "version": "9.17.1.13"}, {"status": "affected", "version": "9.17.1.15"}, {"status": "affected", "version": "9.17.1.20"}, {"status": "affected", "version": "9.17.1.30"}, {"status": "affected", "version": "9.17.1.33"}, {"status": "affected", "version": "9.17.1.39"}, {"status": "affected", "version": "9.17.1.45"}, {"status": "affected", "version": "9.17.1.46"}, {"status": "affected", "version": "9.18.1"}, {"status": "affected", "version": "9.18.1.3"}, {"status": "affected", "version": "9.18.2"}, {"status": "affected", "version": "9.18.2.5"}, {"status": "affected", "version": "9.18.2.7"}, {"status": "affected", "version": "9.18.2.8"}, {"status": "affected", "version": "9.18.3"}, {"status": "affected", "version": "9.18.3.39"}, {"status": "affected", "version": "9.18.3.46"}, {"status": "affected", "version": "9.18.3.53"}, {"status": "affected", "version": "9.18.3.55"}, {"status": "affected", "version": "9.18.3.56"}, {"status": "affected", "version": "9.18.4"}, {"status": "affected", "version": "9.18.4.5"}, {"status": "affected", "version": "9.18.4.8"}, {"status": "affected", "version": "9.18.4.22"}, {"status": "affected", "version": "9.18.4.24"}, {"status": "affected", "version": "9.18.4.29"}, {"status": "affected", "version": "9.18.4.34"}, {"status": "affected", "version": "9.18.4.40"}, {"status": "affected", "version": "9.18.4.47"}, {"status": "affected", "version": "9.18.4.50"}, {"status": "affected", "version": "9.18.4.52"}, {"status": "affected", "version": "9.18.4.53"}, {"status": "affected", "version": "9.18.4.57"}, {"status": "affected", "version": "9.19.1"}, {"status": "affected", "version": "9.19.1.5"}, {"status": "affected", "version": "9.19.1.9"}, {"status": "affected", "version": "9.19.1.12"}, {"status": "affected", "version": "9.19.1.18"}, {"status": "affected", "version": "9.19.1.22"}, {"status": "affected", "version": "9.19.1.24"}, {"status": "affected", "version": "9.19.1.27"}, {"status": "affected", "version": "9.19.1.28"}, {"status": "affected", "version": "9.19.1.31"}, {"status": "affected", "version": "9.19.1.37"}, {"status": "affected", "version": "9.19.1.38"}, {"status": "affected", "version": "9.19.1.42"}, {"status": "affected", "version": "9.20.1"}, {"status": "affected", "version": "9.20.1.5"}, {"status": "affected", "version": "9.20.2"}, {"status": "affected", "version": "9.20.2.10"}, {"status": "affected", "version": "9.20.2.21"}, {"status": "affected", "version": "9.20.2.22"}, {"status": "affected", "version": "9.20.3"}, {"status": "affected", "version": "9.20.3.4"}, {"status": "affected", "version": "9.20.3.7"}, {"status": "affected", "version": "9.20.3.9"}, {"status": "affected", "version": "9.20.3.10"}, {"status": "affected", "version": "9.20.3.13"}, {"status": "affected", "version": "9.20.3.16"}, {"status": "affected", "version": "9.20.3.20"}, {"status": "affected", "version": "9.22.1.1"}, {"status": "affected", "version": "9.22.1.3"}, {"status": "affected", "version": "9.22.1.2"}, {"status": "affected", "version": "9.22.1.6"}, {"status": "affected", "version": "9.22.2"}, {"status": "affected", "version": "9.23.1"}, {"status": "affected", "version": "9.23.1.3"}]}, {"vendor": "Cisco", "product": "Cisco Secure Firewall Threat Defense (FTD) Software", "versions": [{"status": "affected", "version": "6.4.0"}, {"status": "affected", "version": "6.4.0.1"}, {"status": "affected", "version": "6.4.0.3"}, {"status": "affected", "version": "6.4.0.2"}, {"status": "affected", "version": "6.4.0.4"}, {"status": "affected", "version": "6.4.0.5"}, {"status": "affected", "version": "6.4.0.6"}, {"status": "affected", "version": "6.4.0.7"}, {"status": "affected", "version": "6.4.0.8"}, {"status": "affected", "version": "6.4.0.9"}, {"status": "affected", "version": "6.4.0.10"}, {"status": "affected", "version": "6.4.0.11"}, {"status": "affected", "version": "6.4.0.12"}, {"status": "affected", "version": "6.4.0.13"}, {"status": "affected", "version": "6.4.0.14"}, {"status": "affected", "version": "6.4.0.15"}, {"status": "affected", "version": "6.4.0.16"}, {"status": "affected", "version": "6.4.0.17"}, {"status": "affected", "version": "6.4.0.18"}, {"status": "affected", "version": "7.0.0"}, {"status": "affected", "version": "7.0.0.1"}, {"status": "affected", "version": "7.0.1"}, {"status": "affected", "version": "7.0.1.1"}, {"status": "affected", "version": "7.0.2"}, {"status": "affected", "version": "7.0.2.1"}, {"status": "affected", "version": "7.0.3"}, {"status": "affected", "version": "7.0.4"}, {"status": "affected", "version": "7.0.5"}, {"status": "affected", "version": "7.0.6"}, {"status": "affected", "version": "7.0.6.1"}, {"status": "affected", "version": "7.0.6.2"}, {"status": "affected", "version": "7.0.6.3"}, {"status": "affected", "version": "7.0.7"}, {"status": "affected", "version": "7.0.8"}, {"status": "affected", "version": "7.0.8.1"}, {"status": "affected", "version": "7.1.0"}, {"status": "affected", "version": "7.1.0.1"}, {"status": "affected", "version": "7.1.0.2"}, {"status": "affected", "version": "7.1.0.3"}, {"status": "affected", "version": "7.2.0"}, {"status": "affected", "version": "7.2.0.1"}, {"status": "affected", "version": "7.2.1"}, {"status": "affected", "version": "7.2.2"}, {"status": "affected", "version": "7.2.3"}, {"status": "affected", "version": "7.2.4"}, {"status": "affected", "version": "7.2.4.1"}, {"status": "affected", "version": "7.2.5"}, {"status": "affected", "version": "7.2.5.1"}, {"status": "affected", "version": "7.2.6"}, {"status": "affected", "version": "7.2.7"}, {"status": "affected", "version": "7.2.5.2"}, {"status": "affected", "version": "7.2.8"}, {"status": "affected", "version": "7.2.8.1"}, {"status": "affected", "version": "7.2.9"}, {"status": "affected", "version": "7.2.10"}, {"status": "affected", "version": "7.2.10.2"}, {"status": "affected", "version": "7.3.0"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "7.3.1.1"}, {"status": "affected", "version": "7.3.1.2"}, {"status": "affected", "version": "7.4.0"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.4.1.1"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "7.4.2.1"}, {"status": "affected", "version": "7.4.2.2"}, {"status": "affected", "version": "7.4.2.3"}, {"status": "affected", "version": "7.4.2.4"}, {"status": "affected", "version": "7.6.0"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.6.2.1"}, {"status": "affected", "version": "7.7.0"}, {"status": "affected", "version": "7.7.10"}, {"status": "affected", "version": "7.7.10.1"}]}]}], "published": "2026-03-04T18:16:25.137", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-m9sx6MbC", "tags": ["Vendor Advisory"], "source": "psirt@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-330"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition.\r\n\r This vulnerability is due to insufficient error checking when processing SAML messages. An attacker could exploit this vulnerability by sending crafted SAML messages to the SAML service. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition."}, {"lang": "es", "value": "Una vulnerabilidad en la funci\u00f3n de inicio de sesi\u00f3n \u00fanico (SSO) SAML 2.0 de Cisco Secure Firewall ASA Software y Secure FTD Software podr\u00eda permitir a un atacante remoto no autenticado provocar que el dispositivo se recargue inesperadamente, lo que resultar\u00eda en una condici\u00f3n de DoS. Esta vulnerabilidad se debe a una comprobaci\u00f3n de errores insuficiente al procesar mensajes SAML. Un atacante podr\u00eda explotar esta vulnerabilidad enviando mensajes SAML manipulados al servicio SAML. Un exploit exitoso podr\u00eda permitir al atacante provocar que el dispositivo se recargue, lo que resultar\u00eda en una condici\u00f3n de DoS."}], "lastModified": "2026-08-11T19:40:47.230", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74292810-417D-42CC-9123-55166145E91D", "versionEndExcluding": "9.16.4.85", "versionStartIncluding": "9.12.1"}, {"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7EFC1809-7619-43ED-80FD-0FC28C876879", "versionEndExcluding": "9.18.4.66", "versionStartIncluding": "9.17.1"}, {"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4988A136-196A-448B-A416-992803647AB2", "versionEndExcluding": "9.20.4", "versionStartIncluding": "9.19.1"}, {"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55B05CD4-4849-471F-ACC5-0E0478568A2D", "versionEndExcluding": "9.22.2.4", "versionStartIncluding": "9.22.1.1"}, {"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61AA6D92-28AC-41E2-8CD3-F7094A079D65", "versionEndExcluding": "9.23.1.7", "versionStartIncluding": "9.23.1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D9356BF-153F-46DE-A84C-88C743291468", "versionEndExcluding": "7.0.9", "versionStartIncluding": "6.4.0"}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2E5D82E-E596-48CD-AFBB-3FB39F6684A1", "versionEndExcluding": "7.2.11", "versionStartIncluding": "7.1.0"}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3D0EFB8-E018-4732-B99B-9374C1EF602E", "versionEndExcluding": "7.4.3", "versionStartIncluding": "7.3.0"}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C131685-D69C-4460-BFFC-06DA5AD43038", "versionEndExcluding": "7.6.4", "versionStartIncluding": "7.6.0"}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "491E1C03-FE39-4A29-82B6-85B85494E57D", "versionEndExcluding": "7.7.11", "versionStartIncluding": "7.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@cisco.com"}