CVE-2026-20250

CVE-2026-20250 is a denial-of-service flaw in the Datagram TLS (DTLS) message handling of Cisco Secure Firewall ASA Software and Threat Defense (FTD) Software running on Cisco Secure Firewall 3100 and 4200 Series appliances. The bug stems from improper resource management (CWE-772) when processing certain DTLS messages, causing resources to not be released correctly. An unauthenticated, remote attacker can trigger it by sending a crafted stream of DTLS traffic to the device; a successful exploit causes the firewall to reload, taking down traffic inspection and any VPN services it terminates. Only 3100 and 4200 Series devices running ASA or FTD software are affected. There is currently no known exploitation, no CISA KEV listing, and no public proof-of-concept.

What to do: Inventory for Cisco Secure Firewall 3100/4200 Series appliances running ASA or FTD software, especially those terminating remote-access VPN with DTLS, and upgrade to the fixed release listed in Cisco's security advisory. As interim mitigation, restrict untrusted DTLS traffic from reaching the device (e.g., filter DTLS/UDP 443 at the perimeter or disable DTLS in VPN group policies if feasible). Monitor appliances for unexpected reloads, which may indicate exploitation attempts.