CVE-2026-20014 Denial of service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software

High 7.7 Published 4 Mar 2026 Updated 4 Mar 2026

An authenticated remote attacker can cause a denial of service by sending crafted IKEv2 packets, exhausting memory and forcing a device reload.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-20014?

CVE-2026-20014 is a high-severity denial of service vulnerability in Cisco Adaptive Security Appliance Software, published on 4 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, remote attacker with valid VPN user credentials to cause a DoS condition on an affected device that may also impact the availability of services to devices elsewhere in the network. This vulnerability is due to the improper processing of IKEv2 packets. An attacker could exploit this vulnerability by sending crafted, authenticated IKEv2 packets to an affected device. A successful exploit could allow the attacker to exhaust memory, causing the device to reload.

Weakness: CWE-401

Which versions are affected by CVE-2026-20014?

It affects 2 products.

Products include Cisco Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense.

How do I fix CVE-2026-20014?

No fix has been published for CVE-2026-20014 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-20014 being exploited?

There is no known exploitation of CVE-2026-20014 in the wild and no public exploit code.

All Cisco Adaptive Security Appliance Software vulnerabilities

Sources

Also known as GHSA-hm6q-48c6-p943.