CVE-2026-20056 Cisco Secure Web Appliance TBD Bypass Vulnerability
Unauthenticated attackers can bypass anti-malware scanning to deliver malicious archives to users via Cisco Secure Web Appliance.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-20056?
CVE-2026-20056 is a medium-severity vulnerability in Cisco Secure Web Appliance, published on 4 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the Dynamic Vectoring and Streaming (DVS) Engine implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass the anti-malware scanner, allowing malicious archive files to be downloaded. This vulnerability is due to improper handling of certain archive files. An attacker could exploit this vulnerability by sending a crafted archive file, which should be blocked, through an affected device. A successful exploit could allow the attacker to bypass the anti-malware scanner and download malware onto an end user workstation. The downloaded malware will not automatically execute unless the end user extracts and launches the malicious file.
Weakness: CWE-494
Which versions are affected by CVE-2026-20056?
How do I fix CVE-2026-20056?
No fix has been published for CVE-2026-20056 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-20056 being exploited?
There is no known exploitation of CVE-2026-20056 in the wild and no public exploit code.
Sources
Also known as GHSA-5v8r-9wmj-294x.