CVE-2026-20120: cisco cisco secure firewall adaptive security appliance (asa) software Improper Access Control
Vulnerability summary
CVE-2026-20120 is a medium (CVSS 5.8) Improper Access Control vulnerability in cisco cisco secure firewall adaptive security appliance (asa) software. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 33.7% of scored vulnerabilities.
Timeline
- 16-09-2026PublishedVulnerability first disclosed.
- 18-09-2026Last modifiedVulnerability information updated.
Description
A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access controls. This vulnerability is due to a logic error in populating group access control policies (ACPs) with OGS configured. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
0.00 pp
From 0.41% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco2 products
- cisco secure firewall adaptive security appliance (asa) software9.23.1 | 9.22.1.1 | 9.22.1.3 | 9.22.1.2 | 9.22.1.6 | 9.22.2 | 9.23.1.3 | 9.22.2.4 | 9.23.1.7 | 9.22.2.9 | 9.23.1.13 | 9.22.2.13 | 9.23.1.19 | 9.22.2.14 | 9.23.1.22 | 9.22.2.20
- cisco secure firewall threat defense (ftd) software7.6.0 | 7.7.0 | 7.6.1 | 7.6.2 | 7.7.10 | 7.7.11 | 7.6.2.1 | 7.7.10.1
1 vendor · 2 products