CVE-2026-20106: 
Cisco Adaptive Security Appliance (ASA) vulnerability analysis and mitigation

CVE-2026-20106 is a memory exhaustion denial-of-service (DoS) vulnerability in the Remote Access SSL VPN, HTTP management, and Mobile User Security (MUS) functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. An unauthenticated, remote attacker can exploit this flaw by sending crafted packets to the Remote Access SSL VPN server, exhausting device memory and causing a DoS condition that requires a manual reboot. The vulnerability was disclosed on March 4, 2026, as part of Cisco's March 2026 Semiannual Cisco Secure Firewall Security Advisory Bundled Publication. It carries a CVSS v3.1 base score of 5.3 (Medium) (Cisco Advisory).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime) — the software fails to properly release memory allocated during processing of user-supplied input, leading to gradual memory exhaustion. The vulnerability arises because the affected components trust user input without adequate validation, allowing an attacker to craft packets that cause memory to be allocated but never freed. Exploitation requires no authentication and no user interaction; the attack vector is network-based with low complexity. CVE-2026-20106 specifically affects the SSL VPN server, HTTP management server (when configured with allowed access hosts), and MUS functionality when any of these features are enabled. The vulnerability was discovered during internal security testing by Jason Crowder of the Cisco Advanced Security Initiatives Group (ASIG) (Cisco Advisory).

Successful exploitation causes the affected Cisco ASA or FTD device to stop responding entirely, resulting in a denial-of-service condition that requires a manual reboot to recover — disrupting all network traffic and VPN services handled by the appliance. The impact is limited to availability; there is no confidentiality or integrity impact. Because Cisco ASA and FTD devices commonly serve as network perimeter security appliances, a successful DoS attack could disrupt remote access VPN connectivity for an entire organization and potentially impair network security enforcement during the outage period (Cisco Advisory).

As of the time of disclosure, Cisco PSIRT is not aware of any public announcements or malicious use of this vulnerability in the wild. No public proof-of-concept exploit code is known to exist. The EPSS score is approximately 0.043%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Cisco Advisory).

1. Reconnaissance: Identify internet-facing Cisco ASA or FTD devices with Remote Access SSL VPN, HTTP management, or MUS features enabled using tools such as Shodan or Censys, targeting vulnerable software versions.
2. Confirm target feature exposure: Verify that the target device exposes the SSL VPN endpoint (typically on TCP 443) or the HTTP management interface by probing for expected Cisco ASA/FTD web interface responses.
3. Craft malicious packets: Prepare crafted network packets (e.g., specially structured SSL/TLS or HTTP requests) designed to trigger memory allocation without corresponding deallocation in the VPN or management processing code.
4. Send repeated crafted packets: Continuously send the crafted packets to the target device's SSL VPN or HTTP management port to progressively exhaust available device memory.
5. Achieve DoS condition: Once memory is exhausted, the device stops responding to all traffic, resulting in a full denial-of-service condition. Recovery requires a manual reboot by an administrator (Cisco Advisory).

• Network: Unusual high-volume or repeated connection attempts to TCP 443 (SSL VPN) or the HTTP management port of Cisco ASA/FTD devices from unexpected or external IP addresses; connections that do not complete normal TLS handshakes.
• Device Behavior: Cisco ASA or FTD device becomes unresponsive to management access (ASDM, SSH, console) or stops passing traffic; device requires manual reboot to recover.
• Logs: Cisco ASA/FTD system logs showing memory allocation errors, memory exhaustion warnings, or repeated failed connection attempts prior to device becoming unresponsive; syslog messages indicating low memory conditions.
• SNMP/Monitoring: Sudden spike in memory utilization metrics on the firewall appliance as observed via SNMP polling or Cisco Firewall Management Center (FMC) dashboards, followed by device unavailability.

Cisco has released fixed software versions to address this vulnerability; there are no workarounds available. Organizations should upgrade to the following fixed releases or later: ASA Software — 9.16.4.85, 9.18.4.66, 9.20.4, 9.22.2.4, or 9.23.1.7; FTD Software — 7.0.9, 7.2.11, 7.4.3, 7.6.4, or 7.7.11. As an interim risk reduction measure, organizations should restrict access to the SSL VPN, HTTP management, and MUS interfaces to trusted IP addresses only, and monitor affected devices for signs of memory exhaustion. Use the Cisco Software Checker tool to confirm exposure and identify the appropriate fixed release for your deployment (Cisco Advisory).

The vulnerability was disclosed as part of Cisco's March 2026 Semiannual Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software Security Advisory Bundled Publication, which also included several higher-severity DoS vulnerabilities (CVE-2026-20100, CVE-2026-20101, CVE-2026-20103, CVE-2026-20105). The Belgian Centre for Cybersecurity (CCB) issued a warning regarding multiple critical vulnerabilities in Cisco products from this bundle. The Center for Internet Security (CIS) also published an advisory noting that multiple vulnerabilities in Cisco products could allow for remote code execution and DoS conditions. Community reaction has been relatively muted given the Medium severity rating and absence of public exploits (Cisco Advisory).