Cisco Secure Firewall Adaptive Security Appliance Software VPN Web Server heap inspection

Summaryinfo

A vulnerability was found in Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software. It has been rated as critical. This impacts an unknown function of the component VPN Web Server. This manipulation causes heap inspection. This vulnerability is registered as CVE-2026-20039. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software (version unknown). It has been declared as critical. Affected by this vulnerability is an unknown function of the component VPN Web Server. The manipulation with an unknown input leads to a heap inspection vulnerability. The CWE definition for the vulnerability is CWE-244. Using realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to attack, because it is not removed from memory. As an impact it is known to affect availability. The summary by CVE is:

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to ineffective memory management of the VPN web server. An attacker could exploit this vulnerability by sending a large number of crafted HTTP requests to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

It is possible to read the advisory at sec.cloudapps.cisco.com. This vulnerability is known as CVE-2026-20039 since 10/08/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/05/2026).

Upgrading eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• Secure Firewall Adaptive Security Appliance Software
• Secure Firewall Threat Defense Software

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion