CVE-2026-20248 Denial of service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
Remote attackers can cause Cisco ASA and FTD devices to reload via crafted DNS responses, resulting in a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-20248?
CVE-2026-20248 is a medium-severity denial of service vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the DNS over TCP implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the TCP DNS response handler to unexpectedly restart, causing the device to reload. This vulnerability is due to a logic error when parsing a DNS query and tracking the size of the incoming buffers. An attacker could exploit this vulnerability by formatting a crafted reply to a DNS query sent from the targeted device. A successful exploit could allow the attacker to cause the device to reload, causing a denial of service (DoS) condition. Note: The attacker must be able to respond to DNS queries from the device, either by controlling the DNS service or through a machine-in-the-middle attack.
Weakness: CWE-195
Which versions are affected by CVE-2026-20248?
How do I fix CVE-2026-20248?
No fix has been published for CVE-2026-20248 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-20248 being exploited?
There is no known exploitation of CVE-2026-20248 in the wild and no public exploit code.
Sources
Also known as GHSA-qxw6-2w65-g7rg.