What’s Vulnerable › Vulnerabilities
CVE-2026-20102: Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software SAML Reflected Cross-Site Scripting Vulnerability
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-04 · updated 2026-08-11
- Weakness: CWE-79
Description
A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the SAML feature and access sensitive, browser-based information. This vulnerability is due to insufficient input validation of multiple HTTP parameters. An attacker could exploit this vulnerability by persuading a user to access a malicious link. A successful exploit could allow the attacker to conduct a reflected XSS attack through an affected device.
Affected products
- Cisco ASA Software: from 9.16.1 before 9.16.4.89; from 9.17.1 before 9.18.4.71; from 9.20.1 before 9.20.4.19; from 9.22.1.1 before 9.22.2.32; from 9.23.1 before 9.23.1.26 — fixed in 9.16.4.89, 9.18.4.71, 9.20.4.19, 9.22.2.32, 9.23.1.26
- Cisco Firepower Threat Defense Software: from 7.0.0 before 7.0.9; from 7.1.0 before 7.2.11; from 7.4.0 before 7.4.3; from 7.6.0 before 10.0.0 — fixed in 10.0.0, 7.0.9, 7.2.11, 7.4.3
How to fix
Upgrade to a fixed version: Cisco ASA Software 9.16.4.89, 9.18.4.71, 9.20.4.19, 9.22.2.32; Cisco Firepower Threat Defense Software 10.0.0, 7.0.9, 7.2.11, 7.4.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-20102 or the next vulnerability affects your stack