Authentication Bypass Vulnerability in Cisco Secure Web Appliance

CVE-2026-20152

What is CVE-2026-20152?

The authentication service feature of Cisco AsyncOS Software for Cisco Secure Web Appliance contains a vulnerability that may allow an unauthenticated, remote attacker to bypass authentication policy requirements. This situation arises from improper validation of user-supplied authentication input within HTTP requests. An attacker could exploit this issue by sending specially crafted HTTP requests, enabling them to circumvent policy enforcement mechanisms designed to restrict access. While there is no immediate impact on the Cisco Secure Web Appliance, successful exploitation could facilitate access to requests that should otherwise remain restricted.

References