Cisco Secure Firewall Adaptive Security Appliance Software SAML 2.0 Single Sign-on random values

Summaryinfo

A vulnerability labeled as problematic has been found in Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software. Affected by this issue is some unknown functionality of the component SAML 2.0 Single Sign-on. Executing a manipulation can lead to random values. This vulnerability appears as CVE-2026-20101. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic was found in Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software (the affected version unknown). This vulnerability affects an unknown part of the component SAML 2.0 Single Sign-on. The manipulation with an unknown input leads to a random values vulnerability. The CWE definition for the vulnerability is CWE-330. The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. As an impact it is known to affect availability. CVE summarizes:

A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition. This vulnerability is due to insufficient error checking when processing SAML messages. An attacker could exploit this vulnerability by sending crafted SAML messages to the SAML service. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

The advisory is available at sec.cloudapps.cisco.com. This vulnerability was named CVE-2026-20101 since 10/08/2025. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 05/02/2026). This vulnerability is assigned to T1600.001 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 311458 (Cisco Firepower Threat Defense (FTD) Software VPN DoS Vulnerabilities (cisco-sa-asaftd-vpn-m9sx6MbC)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (311458). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• Secure Firewall Adaptive Security Appliance Software
• Secure Firewall Threat Defense Software

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion