The key points: Cisco disclosed 17 vulnerabilities in firewall products including critical flaws (CVSS 10.0). Attackers can execute arbitrary code with root privileges without authentication. Immediate updates are required; no workarounds are available.
Cisco published a total of 17 vulnerabilities in its firewall products on March 4, 2026. Among these are two critical flaws with a maximum CVSS rating of 10.0, which allow attackers to execute arbitrary code with root privileges without authentication.
Cisco has published several security advisories addressing vulnerabilities in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software.
Two vulnerabilities receive the highest possible CVSS rating of 10.0: CVE-2026-20079 enables authentication bypass followed by command execution with root privileges. CVE-2026-20131 enables arbitrary code execution via the web management interface without any authentication.
The remaining 15 vulnerabilities affect, among other things, VPN functionalities (SSL VPN, IKEv2, IPsec) and enable denial-of-service attacks, SQL injection attacks, and unauthorized file access. By exploiting these flaws, attackers can bypass authentication, cause denial-of-service conditions requiring manual restarts, or access sensitive files.
Affected are Cisco Secure Firewall ASA Software, Cisco Secure Firewall Threat Defense Software, Cisco Secure Firewall Management Center Software, and in some cases Cisco Security Cloud Control Firewall Management.
Cisco is providing updated software versions that address all vulnerabilities. No workarounds are available. CERT.at recommends timely updates to a patched version. The Cisco Software Checker enables identification of affected and patched versions.
Source: www.cert.at