CVE-2026-20335

CVE-2026-20335 covers one or more incorrect calculation vulnerabilities (CWE-682) in Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software, discovered internally during a Cisco security review rather than through external reports. The CVSS vector indicates the flaw is reachable over the network without authentication or user interaction, but exploitation requires elevated conditions (AC:H), and the high impact ratings suggest successful attacks could compromise confidentiality, integrity, and availability of the affected device. Organizations running Cisco ASA, FTD, or FMC in any deployment—particularly internet-facing VPN and firewall appliances—are in scope for remediation. As of this analysis, Cisco has addressed the issue in a software hardening release, and there are no reports of exploitation, no public proof-of-concept, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Consult the Cisco PSIRT advisory for this hardening release and upgrade ASA, FTD, and FMC to the fixed versions it specifies, since exact affected ranges are not listed in the summary data. In the interim, limit exposure of ASA/FTD management and VPN interfaces to the internet and verify no anomalous device behavior. Monitor Cisco PSIRT for updates, as the vague CWE-682 grouping and high-attack-complexity score suggest details may be refined over time.