CVE-2026-20249: cisco cisco secure firewall adaptive security appliance (asa) software Incorrect Type Conversion or Cast

Vulnerability summary

CVE-2026-20249 is a high (CVSS 8.6) Incorrect Type Conversion or Cast vulnerability in cisco cisco secure firewall adaptive security appliance (asa) software. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.5% of scored vulnerabilities.

Timeline

1. 16-09-2026
   PublishedVulnerability first disclosed.
2. 18-09-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability in the certification authentication feature of Internet Key Exchange version 2 (IKEv2) for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly. This vulnerability is due to a logic error during the certificate authentication phase of the IKEv2 connection setup. An attacker could exploit this vulnerability by attempting to establish an IKEv2 VPN connection with a crafted certificate. A successful exploit could allow the attacker to cause the IKEv2 process to crash, causing a denial of service (DoS) condition.

• CWE-704Incorrect Type Conversion or CastThe product does not correctly convert an object, resource, or structure from one type to a different type.