What’s Vulnerable › Vulnerabilities
CVE-2026-20330: Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Improper Neutralization Vulnerabilities
- Severity: critical (CVSS 9.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-16 · updated 2026-09-18
- Weakness: CWE-707
Description
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20330 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707.
Summary
Cisco released a hardening update for Cisco Secure ASA Software, Secure Firewall Threat Defense Software, and Secure Firewall Management Center Software addressing multiple internally discovered improper neutralization vulnerabilities (CWE-707), tracked as CVE-2026-20330 with a critical CVSS score of 9.9. These flaws could allow attackers to bypass input handling protections, potentially leading to serious compromise of affected firewall and management appliances. The issue is not listed in CISA KEV and SSVC reports no known exploitation, with EPSS estimating only a 0.5% chance of exploitation in 30 days. Affected organizations should apply the September 2026 hardening release for the relevant Cisco products as soon as possible.
أصدرت Cisco تحديث تقوية لبرامج Cisco Secure ASA Software وSecure Firewall Threat Defense Software وSecure Firewall Management Center Software يعالج عدة ثغرات تحييد غير صحيح تم اكتشافها داخلياً (CWE-707)، وتُتابع تحت المعرف CVE-2026-20330 بدرجة خطورة حرجة CVSS 9.9. قد تسمح هذه العيوب للمهاجمين بتجاوز ضوابط معالجة المدخلات، مما قد يؤدي إلى اختراق خطير لأجهزة الجدار الناري والإدارة المتأثرة. الثغرة غير مدرجة في CISA KEV ولا تشير SSVC إلى أي استغلال معروف، فيما تقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 0.5% فقط. على المؤسسات المتأثرة تطبيق إصدار التقوية الصادر في سبتمبر 2026 للمنتجات المعنية من Cisco في أقرب وقت ممكن.
Affected products
- Cisco ASA Software: 9.16.1, 9.16.1.28, 9.16.2, 9.16.2.3, 9.16.2.7, 9.16.2.11 (+115)
- Cisco Firepower Management Center: 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.2.0 (+62)
- Cisco Firepower Threat Defense Software: 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.0.2.1, 7.0.3 (+35)
In the news
References
Get alerted when CVE-2026-20330 or the next vulnerability affects your stack