CVE-2026-20135

CVE-2026-20135 is a double-free (improper buffer management, CWE-415) flaw in the TLS 1.3 implementation of Cisco Secure Firewall Threat Defense (FTD) Software. An unauthenticated, remote attacker can trigger it by sending a crafted TLS 1.3 packet to any TLS 1.3-enabled listening socket, covering both data traffic and user-management traffic, and exploitation can succeed before or after connection authentication. A successful attack crashes the LINA process, forcing the device to reload and causing a denial of service; confidentiality and integrity are not impacted. Any organization running FTD with TLS 1.3 enabled on exposed listeners is affected. No exploitation in the wild or public proof-of-concept is currently known, and the flaw is not in CISA's KEV catalog.

What to do: Consult the Cisco security advisory (assigned by [email protected]) for fixed FTD releases and upgrade as soon as fixed software is available for your release train. As interim mitigation, disable TLS 1.3 on listening sockets where possible or restrict access to TLS 1.3-enabled interfaces (especially user-management traffic) to trusted networks only. Check devices for unexpected reloads or LINA process crashes, which may indicate exploitation attempts.