CVE-2026-20222

Cisco Secure Firewall ASA and FTD software contain a memory leak (CWE-401) in the handling of EIGRP update messages, caused by improper resource management. An unauthenticated attacker positioned adjacent to the device (on a segment where EIGRP is configured) can send crafted EIGRP updates at a high rate, exhausting memory until the firewall reloads unexpectedly. A successful attack yields only a denial of service (CVSS availability impact, no confidentiality or integrity loss), but repeated exploitation could keep the firewall crashing, disrupting all traffic it inspects. Only deployments of Cisco ASA or FTD software with EIGRP enabled are affected, and the attacker must be able to reach an EIGRP-enabled interface. Exploitation status: no reports of in-the-wild abuse, no public proof-of-concept, and the flaw is not in CISA KEV.

What to do: Upgrade ASA and FTD to the fixed releases listed in the Cisco security advisory. As interim mitigation, enable EIGRP neighbor authentication and/or interface access lists restricting which hosts can send EIGRP packets to the firewall, and disable EIGRP where it is not required. Check whether EIGRP is configured on any interface and monitor device memory utilization for unexplained growth.