CVE-2026-20249

CVE-2026-20249 is a denial-of-service vulnerability in the certificate authentication feature of Internet Key Exchange version 2 (IKEv2) in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software, caused by a logic error (CWE-704) during the certificate authentication phase of IKEv2 connection setup. An unauthenticated, remote attacker can trigger it simply by attempting to establish an IKEv2 VPN connection with a crafted certificate, with no valid credentials or user interaction required. A successful exploit crashes the IKEv2 process, causing the device to reload unexpectedly and producing a denial-of-service condition that disrupts VPN services on the appliance. Any organization running an ASA or FTD VPN gateway with IKEv2 enabled, particularly one exposed to the internet, is potentially affected. As of the advisory data there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation is known.

What to do: Upgrade ASA/FTD to a fixed release identified in Cisco's advisory and verified with the Cisco Software Checker (no fixed version numbers are present in the source data). Until patching, limit exposure of UDP 500/4500 to known VPN peers, disable IKEv2 remote access or certificate-based authentication where it is not required, and confirm high-availability/failover is configured to absorb a reload. Monitor devices for unexpected IKEv2 process crashes or reloads and track Cisco PSIRT for updates on exploitation status.