CVE-2026-20295

CVE-2026-20295 is a memory-exhaustion flaw in sftunnel, the protocol Cisco Secure FMC (Firepower Management Center) and Secure FTD (Firepower Threat Defense) devices use to communicate with each other. Because memory resources are improperly managed during sftunnel TLS connection setup, an unauthenticated remote attacker can send crafted sftunnel TLS frames to exhaust the device's available memory. A successful attack does not disclose data or alter configurations, but can crash or stall the affected device, producing a denial-of-service condition; on FTD that can mean loss of firewall/IPS enforcement or management connectivity, and the scope-changed CVSS score (S:C) reflects that exploitation can impact other devices in the FMC-FTD deployment. Any organization running Cisco Secure FMC or Secure FTD software is potentially affected, particularly where sftunnel-capable interfaces are reachable by untrusted networks. As of this analysis there is no known public proof-of-concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been confirmed.

What to do: Monitor the Cisco PSIRT advisory for fixed releases and upgrade FMC and FTD deployments as soon as fixed software is available. Until then, restrict access to the sftunnel service (TCP 8305 by default) so it is reachable only from trusted management/peer networks and not from the internet, and watch for unexplained memory pressure, service restarts, or DoS symptoms on FMC and FTD devices.