Affects widely deployed Cisco Secure Firewall ASA/FTD; high-severity DoS via unauthenticated SAML, could disrupt networks.
CVE-2026-20101
Unauthenticated SAML SSO DoS on Cisco ASA/FTD; device reloads.
Is CVE-2026-20101 being exploited?
Not confirmed. CVE-2026-20101 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked. EPSS currently estimates a 0.35% probability of exploitation in the next 30 days.
How severe is CVE-2026-20101?
CVE-2026-20101 is rated High with a CVSS score of 8.6. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-20101?
Yes. A fix has been recorded for CVE-2026-20101. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2026-20101 affect?
CVE-2026-20101 affects Cisco Secure Firewall ASA Software, Cisco Secure Firewall FTD Software. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2026-20101?
Patch when available; monitor SAML traffic and apply mitigations.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
Unauthenticated attacker can trigger reload of Cisco ASA/FTD by sending crafted SAML messages, causing DoS and potential network disruption.
Immediate action required
- affected9.12.1
- affected9.12.1.2
- affected9.12.1.3
- affected9.12.2
- affected9.12.2.4
- affected9.12.2.5
- affected9.12.2.9
- affected9.12.3
- affected9.12.3.2
- affected9.12.3.7
- affected9.12.4
- affected9.12.3.12
- affected9.12.3.9
- affected9.12.2.1
- affected9.12.4.2
- affected9.12.4.4
- affected9.12.4.7
- affected9.12.4.10
- affected9.12.4.13
- affected9.12.4.8
- affected9.12.4.18
- affected9.12.4.24
- affected9.12.4.26
- affected9.12.4.29
- affected9.12.4.30
- affected9.12.4.35
- affected9.12.4.37
- affected9.12.4.38
- affected9.12.4.39
- affected9.12.4.40
- affected9.12.4.41
- affected9.12.4.47
- affected9.12.4.48
- affected9.12.4.50
- affected9.12.4.52
- affected9.12.4.54
- affected9.12.4.55
- affected9.12.4.56
- affected9.12.4.58
- affected9.12.4.62
- affected9.12.4.65
- affected9.12.4.67
- affected9.16.1
- affected9.16.1.28
- affected9.16.2
- affected9.16.2.3
- affected9.16.2.7
- affected9.16.2.11
- affected9.16.2.13
- affected9.16.2.14
- affected9.16.3
- affected9.16.3.3
- affected9.16.3.14
- affected9.16.3.15
- affected9.16.3.19
- affected9.16.3.23
- affected9.16.4
- affected9.16.4.9
- affected9.16.4.14
- affected9.16.4.19
- affected9.16.4.27
- affected9.16.4.38
- affected9.16.4.39
- affected9.16.4.42
- affected9.16.4.48
- affected9.16.4.55
- affected9.16.4.57
- affected9.16.4.61
- affected9.16.4.62
- affected9.16.4.67
- affected9.16.4.70
- affected9.16.4.71
- affected9.16.4.76
- affected9.16.4.82
- affected9.16.4.84
- affected9.17.1
- affected9.17.1.7
- affected9.17.1.9
- affected9.17.1.10
- affected9.17.1.11
- affected9.17.1.13
- affected9.17.1.15
- affected9.17.1.20
- affected9.17.1.30
- affected9.17.1.33
- affected9.17.1.39
- affected9.17.1.45
- affected9.17.1.46
- affected9.18.1
- affected9.18.1.3
- affected9.18.2
- affected9.18.2.5
- affected9.18.2.7
- affected9.18.2.8
- affected9.18.3
- affected9.18.3.39
- affected9.18.3.46
- affected9.18.3.53
- affected9.18.3.55
- affected9.18.3.56
- affected9.18.4
- affected9.18.4.5
- affected9.18.4.8
- affected9.18.4.22
- affected9.18.4.24
- affected9.18.4.29
- affected9.18.4.34
- affected9.18.4.40
- affected9.18.4.47
- affected9.18.4.50
- affected9.18.4.52
- affected9.18.4.53
- affected9.18.4.57
- affected9.19.1
- affected9.19.1.5
- affected9.19.1.9
- affected9.19.1.12
- affected9.19.1.18
- affected9.19.1.22
- affected9.19.1.24
- affected9.19.1.27
- affected9.19.1.28
- affected9.19.1.31
- affected9.19.1.37
- affected9.19.1.38
- affected9.19.1.42
- affected9.20.1
- affected9.20.1.5
- affected9.20.2
- affected9.20.2.10
- affected9.20.2.21
- affected9.20.2.22
- affected9.20.3
- affected9.20.3.4
- affected9.20.3.7
- affected9.20.3.9
- affected9.20.3.10
- affected9.20.3.13
- affected9.20.3.16
- affected9.20.3.20
- affected9.22.1.1
- affected9.22.1.3
- affected9.22.1.2
- affected9.22.1.6
- affected9.22.2
- affected9.23.1
- affected9.23.1.3
- affected6.4.0
- affected6.4.0.1
- affected6.4.0.3
- affected6.4.0.2
- affected6.4.0.4
- affected6.4.0.5
- affected6.4.0.6
- affected6.4.0.7
- affected6.4.0.8
- affected6.4.0.9
- affected6.4.0.10
- affected6.4.0.11
- affected6.4.0.12
- affected6.4.0.13
- affected6.4.0.14
- affected6.4.0.15
- affected6.4.0.16
- affected6.4.0.17
- affected6.4.0.18
- affected7.0.0
- affected7.0.0.1
- affected7.0.1
- affected7.0.1.1
- affected7.0.2
- affected7.0.2.1
- affected7.0.3
- affected7.0.4
- affected7.0.5
- affected7.0.6
- affected7.0.6.1
- affected7.0.6.2
- affected7.0.6.3
- affected7.0.7
- affected7.0.8
- affected7.0.8.1
- affected7.1.0
- affected7.1.0.1
- affected7.1.0.2
- affected7.1.0.3
- affected7.2.0
- affected7.2.0.1
- affected7.2.1
- affected7.2.2
- affected7.2.3
- affected7.2.4
- affected7.2.4.1
- affected7.2.5
- affected7.2.5.1
- affected7.2.6
- affected7.2.7
- affected7.2.5.2
- affected7.2.8
- affected7.2.8.1
- affected7.2.9
- affected7.2.10
- affected7.2.10.2
- affected7.3.0
- affected7.3.1
- affected7.3.1.1
- affected7.3.1.2
- affected7.4.0
- affected7.4.1
- affected7.4.1.1
- affected7.4.2
- affected7.4.2.1
- affected7.4.2.2
- affected7.4.2.3
- affected7.4.2.4
- affected7.6.0
- affected7.6.1
- affected7.6.2
- affected7.6.2.1
- affected7.7.0
- affected7.7.10
- affected7.7.10.1
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.