Cisco Secure Firewall (ASA, FTD, FMC): 8 critical hardening flaws (CVE-2026-20329, CVE-2026-20330) fixed
CVE-2026-20329 CVE-2026-20330 CVE-2026-20331 CVE-2026-20332 CVE-2026-76418
Published 29/10/2026 09:03 · Updated 29/10/2026 09:04 (revision 2)
Timeline
3 events over 1 d 8 h
- 28/10/2026CorroboratedVulnCheck KEV+10 h
- 28/10/2026 11:28ConfirmedNCSC-NL advisories+21 h
- 29/10/2026 09:03Published on WatchtowerPro CISO
In short
Cisco published a Critical hardening advisory on 16/09/2026 at 18:00 Amsterdam time for Secure Firewall ASA, Threat Defense (FTD) and Management Center (FMC) software. Cisco's internal review found the flaws and grouped them by weakness class, one CVE per class (CVE-2026-20329 to CVE-2026-20336). Four of the eight have a maximum CVSS of 9.0 or higher. Shodan estimates about 25,207 internet-facing Cisco ASA / Secure Firewall servers worldwide, 5,344 of them in the EU (29/10/2026); how many run an affected version is not yet known.
How bad is it
Critical. Cisco rates the worst flaws very high, and they apply to every configuration, so affected firewalls need updating; Cisco gives no details of what an attacker can do.
Being exploited.
Severity score
The worst of 5 CVEs · CVSS from the vendor, via our research, read 28/10/2026. CVE-2026-76418: no score published yet.
What an attacker needs
- Internet access to itNot published yet
- A loginNot published yet
- A user to clickNot published yet
- Special settingsNot published yet
Red helps the attacker, blue holds them back, grey is not published yet.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Cisco Secure Firewall ASA Software, Secure Firewall Threat Defense (FTD) Software and Secure Firewall Management Center (FMC) Software, regardless of device configuration.
- ASA hot fixes 9.18.4.135, 9.20.4.235, 9.22.3.191, 9.23.1.195, 9.23.1.211, 9.24.1.155 and 9.24.1.221 are affected and must move to the first fixed release.
Fixed in
- 9.16 branch: 9.16.4.103
- 9.18 branch: 9.18.4.94
- 9.20 branch: 9.20.4.49
- 9.22 branch: 9.22.3.26
- 9.23 branch: 9.23.1.47
- 9.24 branch: 9.24.1.26
- 7.0 branch: 7.0.10
- 7.2 branch: 7.2.12
What to do now
- Update to the first fixed release: ASA 9.16.4.103, 9.18.4.94, 9.20.4.49, 9.22.3.26, 9.23.1.47 or 9.24.1.26; FTD and FMC 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0. Do this first for FMC.
- Devices on a Cisco hot fix are affected and must still move to the first fixed release; confirm the exact build in Cisco's Software Checker, as the ASA table was corrected on 18/09/2026 at 17:50 Amsterdam time.
- Interim measure: keep FMC management interfaces off the public internet and limited to trusted networks. This reduces exposure but does not make a device safe; Cisco names no workaround.
- Check FMC for compromise: in expert mode run zgrep "package_info.*license" /var/log/messages*. A line containing /var/tmp/license.tmp means the device may have been exploited; contact Cisco TAC.
- Cisco says the hot fixes prevent future attacks only and may not remove an existing compromise.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 6 open questions, followed up as sources answer, all 6 sources with their dates and every revision. And technology matching: which of your systems run Cisco ASA / Secure Firewall, at which version, fixed or not - and what each one needs.
Main sources
NCSC-2026-0458 [1.00] [M/H] Kwetsbaarheden verholpen in Cisco Secure Firewall ASA, Threat Defense en Management Center CERT · Known exploited (VulnCheck KEV): Cisco Cisco Secure Firewall ASA and Cisco Secure FTD - Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL Research · Cisco Security Advisory: Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software Hardening Release: September 2026 Research
Data: Shodan - Cisco ASA / Secure Firewall (estimate, 29/10/2026)