CVE-2026-20008: 
Cisco Adaptive Security Appliance (ASA) vulnerability analysis and mitigation

CVE-2026-20008 is a Lua code injection vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software that allows an authenticated, local attacker with Administrator credentials to execute arbitrary code as root on the underlying operating system. The vulnerability was disclosed on March 4, 2026, as part of Cisco's March 2026 Semiannual Cisco Secure Firewall Security Advisory Bundled Publication. Affected ASA versions include 9.12.1–9.16.4.84, 9.17.1–9.18.4.65, 9.19.1–9.20.3.x, 9.22.1.1–9.22.2.3, and 9.23.1–9.23.1.6; affected FTD versions include 6.4.0–7.0.8, 7.1.0–7.2.10, 7.3.0–7.4.2, 7.6.0–7.6.3, and 7.7.0–7.7.10. Cisco FMC Software is not affected. The CVSS v3.1 base score is 6.0 (Medium) (Cisco Advisory).

The root cause is improper input sanitization (CWE-78: Improper Neutralization of Special Elements used in an OS Command) in a small subset of CLI commands on ASA and FTD software. An attacker exploits this by crafting valid Lua code and submitting it as a malicious parameter to an affected CLI command, causing the Lua interpreter to execute attacker-controlled code in the context of the underlying OS as root. The attack vector is local, requiring the attacker to already have authenticated CLI access with Administrator-level privileges — there is no network-based exploitation path. The vulnerability was discovered internally by Kyle Ossinger of the Cisco Advanced Security Initiatives Group (ASIG) (Cisco Advisory).

Successful exploitation allows an authenticated Administrator to escalate privileges to root on the underlying operating system of the affected firewall appliance, resulting in high confidentiality and integrity impact (availability is not affected per the CVSS scoring). An attacker achieving root access could read sensitive configuration data, cryptographic material, or VPN credentials stored on the device, modify firewall rules or security policies, and potentially use the compromised appliance as a pivot point for lateral movement into protected network segments. Because ASA and FTD devices are typically deployed as network security perimeter controls, their compromise could have significant downstream consequences for the environments they protect (Cisco Advisory).

As of the advisory publication date, Cisco PSIRT is not aware of any public announcements or malicious use of this vulnerability in the wild. No public proof-of-concept exploit code has been identified. The EPSS score is approximately 0.022% (0.000220), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires valid Administrator credentials and local access, significantly limiting the attacker pool (Cisco Advisory).

1. Gain Administrator Access: Obtain valid Administrator-level credentials for the target Cisco ASA or FTD device through credential theft, phishing, or reuse of compromised credentials.
2. Authenticate to CLI: Log in to the device CLI via SSH, console, or another permitted management interface using the Administrator account.
3. Identify Vulnerable CLI Commands: Enumerate the small subset of CLI commands that accept user-supplied parameters passed to the Lua interpreter. Specific command names have not been publicly disclosed.
4. Craft Malicious Lua Payload: Construct a valid Lua code snippet designed to execute OS-level commands (e.g., spawning a shell, reading sensitive files, or modifying system configuration) as root.
5. Inject Payload via CLI Parameter: Submit the crafted Lua code as a parameter value to the vulnerable CLI command, bypassing input sanitization.
6. Achieve Root Code Execution: The Lua interpreter executes the injected code with root privileges on the underlying OS, enabling full device compromise (Cisco Advisory).

• Logs: Unexpected or anomalous CLI command executions logged in the ASA/FTD audit or syslog output, particularly commands with unusual parameter strings containing Lua syntax (e.g., os.execute, io.popen, dofile).
• Logs: Authentication events showing Administrator logins from unexpected source IPs or at unusual times in the device's AAA logs.
• Process/System: Evidence of unexpected processes spawned by the firewall management process running as root (detectable via show processes or OS-level inspection if shell access is available).
• File System: Unexpected new files or modifications to system files on the firewall appliance, particularly in directories writable by root.
• Network: Unusual outbound connections from the firewall management interface to external IPs, which may indicate post-exploitation activity such as data exfiltration or C2 communication.

Cisco has released fixed software versions to address this vulnerability. For ASA Software, fixed versions include 9.16.4.85, 9.18.4.66, 9.20.4, 9.22.2.4, and 9.23.1.7. For FTD Software, fixed versions include 7.0.9, 7.2.11, 7.4.3, 7.6.4, and 7.7.11. Cisco confirms there are no workarounds available for this vulnerability. Administrators should use the Cisco Software Checker tool to identify their exposure and upgrade to the appropriate fixed release as soon as possible. As a defense-in-depth measure, organizations should restrict CLI access to firewall devices to only trusted administrators and enforce multi-factor authentication for management access (Cisco Advisory).

The vulnerability was part of Cisco's March 2026 Semiannual Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software Security Advisory Bundled Publication, which received coverage from the Center for Internet Security (CIS) in an advisory noting multiple vulnerabilities in Cisco products could allow for remote code execution (CIS Advisory). Community and threat intelligence aggregators such as VulDB and Vulners indexed the vulnerability shortly after disclosure. General security community reaction has been measured given the Medium severity rating and the requirement for Administrator credentials, with no significant alarm or widespread discussion noted.