CVE-2026-20049: 
Cisco Adaptive Security Appliance (ASA) vulnerability analysis and mitigation

CVE-2026-20049 is a denial-of-service (DoS) vulnerability in the processing of Galois/Counter Mode (GCM)-encrypted IKEv2 IPsec traffic in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. An authenticated, remote attacker with valid VPN credentials can trigger an unexpected device reload by sending crafted GCM-encrypted IPsec traffic. The vulnerability was first published on March 4, 2026, and was discovered internally during a Cisco TAC support case. It carries a CVSS v3.1 base score of 7.7 (High) (Cisco Advisory).

Affected ASA Software versions include 9.18.1–9.18.4.65, 9.19.1–9.19.x (before 9.20.3.20), 9.20.1–9.20.3.19, 9.22.1.1–9.22.2.3, and 9.23.1–9.23.1.2. Affected FTD Software versions include 7.2.0–7.2.10, 7.3.0–7.4.2, 7.6.0–7.6.3, and 7.7.0–7.7.9 (Cisco Advisory).

The root cause is classified as CWE-131 (Incorrect Calculation of Buffer Size): the affected software allocates an insufficiently sized memory block when processing GCM-encrypted IKEv2 IPsec traffic, which can be triggered by crafted ESP (Encapsulating Security Payload) packets (Cisco Advisory). Exploitation requires the attacker to have valid credentials to establish a VPN connection with the affected device, after which specially crafted GCM-encrypted IPsec traffic is sent to trigger the memory allocation flaw. The device is only vulnerable if at least one IPsec IKEv2 proposal is configured to use a GCM cipher (aes-gcm, aes-gcm-192, or aes-gcm-256), which can be verified with the CLI command show running-config crypto ipsec | include gcm (Cisco Advisory). No public proof-of-concept code has been identified.

Successful exploitation causes an unexpected reload of the affected Cisco ASA or FTD device, resulting in a denial-of-service condition that disrupts all traffic passing through the firewall, including VPN tunnels and network security enforcement (Cisco Advisory). There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. However, repeated exploitation could cause sustained outages of perimeter security infrastructure, potentially enabling lateral movement or data exfiltration through the resulting security gap.

As of the advisory publication date, Cisco PSIRT is not aware of any public announcements or malicious use of this vulnerability in the wild (Cisco Advisory). No public proof-of-concept exploit code has been identified. The EPSS score is approximately 0.167%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access (valid VPN credentials), which significantly limits the attacker pool.

1. Reconnaissance: Identify internet-facing Cisco ASA or FTD devices running vulnerable software versions using tools like Shodan or Censys, filtering for IKEv2/IPsec VPN endpoints.
2. Obtain VPN credentials: Acquire valid VPN credentials through phishing, credential stuffing, or other means — exploitation requires authenticated access to establish a VPN connection.
3. Establish VPN connection: Use the obtained credentials to authenticate and establish an IKEv2 IPsec VPN session with the target device.
4. Confirm GCM cipher usage: Verify (or infer from negotiation) that the target device is configured with a GCM-based IPsec proposal (aes-gcm, aes-gcm-192, or aes-gcm-256).
5. Send crafted GCM-encrypted traffic: Transmit specially crafted GCM-encrypted ESP packets designed to trigger the incorrect buffer size allocation in the device's IPsec processing code.
6. Trigger device reload: The malformed traffic causes the device to allocate an insufficiently sized memory block, resulting in an unexpected reload and DoS condition (Cisco Advisory).

• Logs: Unexpected device reload events in system logs; crash or traceback logs referencing IPsec or ESP processing modules; syslog messages indicating abnormal process termination around the time of a reload.
• Network: Unusual or malformed GCM-encrypted IKEv2/ESP traffic from an authenticated VPN peer; repeated IKEv2 session establishments from the same source followed by device instability.
• Process/System: Unexpected device reloads with no hardware or power-related cause; post-reload crash dumps referencing memory allocation failures in IPsec/GCM processing code.
• Configuration: Presence of GCM cipher in IPsec IKEv2 proposals (confirmed via show running-config crypto ipsec | include gcm) on devices running vulnerable software versions (Cisco Advisory).

Cisco has released fixed software versions and confirms there are no workarounds available for this vulnerability (Cisco Advisory). Administrators should upgrade to the following fixed releases:

Cisco ASA Software:

• 9.18.x → 9.18.4.66 or later
• 9.20.x → 9.20.3.20 or later
• 9.22.x → 9.22.2.4 or later
• 9.23.x → 9.23.1.3 or later

Cisco FTD Software:

• 7.2.x → 7.2.11 or later
• 7.3.x–7.4.x → 7.4.3 or later
• 7.6.x → 7.6.4 or later
• 7.7.x → 7.7.10 or later

As a compensating control, restrict VPN access to trusted, known users and monitor for anomalous GCM-encrypted IPsec traffic patterns. Use the Cisco Software Checker tool to confirm exposure and identify the appropriate fixed release.

The vulnerability was part of Cisco's March 2026 Semiannual Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software Security Advisory Bundled Publication, which received coverage from security aggregators including RedPacket Security and CIS (CIS Advisory). Social media activity was limited to automated CVE notification accounts on Mastodon and Bluesky. No notable independent researcher commentary or significant community debate has been identified for this specific CVE.