Cross-Site Scripting Vulnerability in Cisco Secure Firewall Devices
CVE-2026-20070

6.1MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Secure Firewall Adaptive Security Appliance (asa) Software
Cisco Secure Firewall Threat Defense (ftd) Software
Vendor
CVE Published:
4 March 2026

Badges

👾 Exploit Exists

What is CVE-2026-20070?

A vulnerability in the VPN web services of Cisco Secure Firewall ASA and FTD Software allows unauthenticated remote attackers to perform cross-site scripting attacks. This flaw arises from inadequate validation of user input in HTTP requests. By tricking a user into clicking on a link to a malicious site, an attacker could potentially execute arbitrary HTML or script code in the user's browser context of the VPN web server, posing significant security risks to affected users.

Affected Version(s)

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.12.3

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.12.1

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.12.2

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.