CVE-2026-20332

CVE-2026-20332 covers improper access control issues (CWE-284) in Cisco Secure Adaptive Security Appliance (ASA), Secure Firewall Threat Defense (FTD), and Secure Firewall Management Center (FMC) software, discovered during Cisco's internal security review and addressed in a dedicated software hardening release. A remote attacker who already holds a low-privileged account or session (CVSS PR:L over the network, no user interaction) can trigger the flaw. Because the attack scope is changed and confidentiality, integrity, and availability impacts are all rated high, successful exploitation crosses a security boundary, giving the attacker high-impact control over the device or access to data it protects. Any organization running affected ASA, FTD, or FMC releases is exposed, though exploitation requires valid low-privileged credentials. No public proof-of-concept or known exploitation exists; the flaw was internally discovered by Cisco and is not yet in CISA's Known Exploited Vulnerabilities catalog.

What to do: Upgrade ASA, FTD, and FMC devices to the Cisco software hardening release cited in the Cisco PSIRT advisory (specific fixed version numbers should be confirmed there). Until patched, restrict management-plane and VPN access to trusted users and networks, and audit low-privileged accounts and their permissions for access-boundary gaps. Monitor Cisco PSIRT for updates, as exploitation requires a valid low-privileged credential and no public exploit is currently known.