CoreCVE
Back

HIGH

A vulnerability in the LUA interperter of the Remote Access SSL VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with a valid VPN connection to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition

Published Mar 4, 2026

Description

A vulnerability in the LUA interperter of the Remote Access SSL VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with a valid VPN connection to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This does not affect the management or MUS interfaces. This vulnerability is due to trusting user input without validation in the LUA interprerter. An attacker could exploit this vulnerability by sending crafted HTTP packets to the Remote Access SSL VPN server. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-120

Classic Buffer Overflow

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner cisco
Published Mar 4, 2026
Updated Mar 5, 2026
Reserved Oct 8, 2025
Link CVE-2026-20100
CISA Vulnrichment
Updated Mar 5, 2026
NVD
Status Analyzed
Modified Aug 11, 2026
Link CVE-2026-20100
Red Hat
Severity n/a
Public date n/a
Links CVE-2026-20100