Multiple vulnerabilities affecting Cisco ASA, Cisco FTD and Cisco FMC

Cisco Secure Firewall ASA, Cisco Secure Firewall Threat Defense (FTD) and Cisco Secure Firewall Management Center (FMC) are solutions developed by Cisco to ensure the security and management of network infrastructures. ASA and FTD solutions enable infrastructure protection and the implementation of remote access VPN services, and FMC provides a centralized management platform for administering, configuring and monitoring Cisco Secure Firewall devices. These products are affected by several vulnerabilities labeled as follows: CVE-2026-20329: vulnerability related to poor handling of exceptional conditions, including uncaught exceptions and accessible assertions. It is classified critical with a severity score of 9.9 according to CVSS V3.1. CVE-2026-20330: vulnerability linked to incorrect validation of messages or structured data before processing. It is classified critical with a severity score of 9.9 according to CVSS V3.1. CVE-2026-20331: vulnerability linked to the incorrect use of a protection mechanism to defend against certain targeted attacks. It is classified critical with a severity score of 9.6 according to CVSS V3.1. CVE-2026-20332: vulnerability linked to incorrect access control, including authentication, authorization, privilege management and evasion mechanisms; two vulnerabilities belonging to this category are actively exploited. It is classified critical with a severity score of 9.0 according to CVSS V3.1. CVE-2026-20333: vulnerability linked to an incorrect comparison of two entities in a security context. It is classified high with a severity score of 8.8 according to CVSS V3.1. CVE-2026-20334: Vulnerability due to failure to follow proper coding practices. It is classified high with a severity score of 8.4 according to CVSS V3.1. CVE-2026-20335: Vulnerability linked to an incorrect calculation that could produce an unexpected result used later in security decisions or in resource management. It is classified high with a severity score of 8.1 according to CVSS V3.1. CVE-2026-20336: Vulnerability related to mishandling of resources during their lifecycle, including uninitialized variables, null pointers, and resource lifecycle issues. It is classified high with a severity score of 7.5 according to CVSS V3.1.

• Cisco Secure Firewall ASA Software: versions 9.16 and earlier, 9.18, 9.20, 9.22, 9.23, and 9.24;
• Cisco Secure Firewall Threat Defense (FTD) Software and Cisco Secure Firewall Management Center (FMC) Software: versions 7.0 and earlier, 7.2, 7.4, 7.6, 7.7, 10.0, and 10.1;

RECOMMENDED ACTIONS:

• Update affected Cisco Secure Firewall ASA Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software products to patched versions:;
• Cisco Secure Firewall ASA Software: 9.16.4.103, 9.18.4.94, 9.20.4.49, 9.22.3.26, 9.23.1.47, or 9.24.1.26;
• Cisco Secure Firewall Threat Defense (FTD) Software and Cisco Secure Firewall Management Center (FMC) Software: 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0;