CVE-2026-20025 Integer overflow in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software

Medium 6.8 Published 4 Mar 2026 Updated 4 Mar 2026

An authenticated adjacent attacker with the OSPF secret key can cause a denial of service by sending crafted OSPF LSU packets that trigger a heap corruption.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-20025?

CVE-2026-20025 is a medium-severity vulnerability in Cisco Adaptive Security Appliance Software, published on 4 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. To exploit this vulnerability, the attacker must have the OSPF secret key. This vulnerability is due to insufficient input validation when processing OSPF link-state update (LSU) packets. An attacker could exploit this vulnerability by sending crafted OSPF LSU packets. A successful exploit could allow the attacker to corrupt the heap, causing the device to reload, resulting in a DoS condition.

Weakness: CWE-190

Which versions are affected by CVE-2026-20025?

It affects 2 products.

Products include Cisco Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense.

How do I fix CVE-2026-20025?

No fix has been published for CVE-2026-20025 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-20025 being exploited?

There is no known exploitation of CVE-2026-20025 in the wild and no public exploit code.

All Cisco Adaptive Security Appliance Software vulnerabilities

Sources

Also known as GHSA-v9vp-c2f8-43hh.