CVE-2026-20331

CVE-2026-20331 tracks multiple internally discovered vulnerabilities in Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software, all classified as failures of protection mechanisms (CWE-693) and addressed through a software hardening release. Cisco has not published detailed technical specifics, but the CVSS 3.1 vector indicates an attacker needs only adjacent network access, with no privileges or user interaction, and that impact crosses security boundaries (scope changed) with high confidentiality and integrity effects plus low availability impact. This is consistent with a bypass of security controls on a firewall/VPN platform, where successful exploitation could let an attacker defeat protections the appliance is meant to enforce. Any organization running affected ASA, FTD, or FMC software is in scope, and FMC operators should note that the management center can propagate exposure across large fleets of managed FTD devices. As of now there is no known exploitation, no public proof of concept, and the issue is not on the CISA KEV list.

What to do: Consult Cisco's advisory for the hardening release and upgrade ASA, FTD, and FMC to the fixed releases it specifies for your software train, since the bundle covers multiple internally found issues. In the interim, limit adjacent-network reachability to device management interfaces and review VPN and management-plane access controls. Because the flaws were found internally and details are sparse, monitor Cisco PSIRT for updated indicators and remediation guidance.