# CVE-2026-20249

Cisco ASA/FTD IKEv2 certificate auth logic allows remote DoS (device reload).

- Page: https://www.vulneraibility.com/cve/CVE-2026-20249
- CVSS: 8.6
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.42% (percentile 36.0)
- CISA SSVC: exploitation none, automatable yes, technical impact partial (assessed 2026-09-18)
- Weakness: CWE-704
- Published: 2026-09-16

## Affected versions

- Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software: affected 9.16.1; 9.16.1.28; 9.16.2; 9.16.2.3; 9.16.2.7; 9.16.2.11; 9.16.2.13; 9.16.2.14; 9.16.3.3; 9.16.3; 9.16.3.14; 9.18.1; 9.16.3.15; 9.18.1.3; 9.18.2; 9.16.3.19; 9.16.3.23; 9.18.2.5; 9.16.4; 9.18.2.7; 9.19.1; 9.16.4.9; 9.18.2.8; 9.16.4.14; 9.18.3; 9.19.1.5; 9.16.4.18; 9.19.1.9; 9.18.3.39; 9.16.4.19; 9.19.1.12; 9.18.3.46; 9.16.4.27; 9.19.1.18; 9.18.3.53; 9.18.3.55; 9.16.4.38; 9.16.4.39; 9.18.3.56; 9.20.1; 9.16.4.42; 9.19.1.22; 9.18.4; 9.20.1.5; 9.18.4.5; 9.19.1.24; 9.16.4.48; 9.18.4.8; 9.20.2; 9.19.1.27; 9.16.4.55; 9.18.4.22; 9.20.2.10; 9.16.4.57; 9.19.1.28; 9.18.4.24; 9.20.2.21; 9.16.4.61; 9.19.1.31; 9.18.4.29; 9.20.2.22; 9.16.4.62; 9.18.4.34; 9.20.3; 9.16.4.67; 9.16.4.70; 9.18.4.40; 9.23.1; 9.22.1.1; 9.16.4.71; 9.20.3.4; 9.18.4.47; 9.20.3.7; 9.19.1.37; 9.16.4.76; 9.20.3.9; 9.19.1.38; 9.18.4.50; 9.22.1.3; 9.20.3.10; 9.22.1.2; 9.18.4.52; 9.20.3.13; 9.22.1.6; 9.18.4.53; 9.16.4.82; 9.22.2; 9.20.3.16; 9.19.1.42; 9.18.4.57; 9.16.4.84; 9.23.1.3; 9.20.3.20; 9.22.2.4; 9.23.1.7; 9.20.4; 9.22.2.9; 9.23.1.13; 9.20.4.7; 9.22.2.13; 9.18.4.66; 9.20.4.10; 9.23.1.19; 9.16.4.85; 9.22.2.14; 9.18.4.67; 9.24.1; 9.18.4.68; 9.23.1.22; 9.20.4.14; 9.22.2.20; 9.18.4.71; 9.20.4.19; 9.23.1.26; 9.16.4.89; 9.22.2.32; 9.18.4.76; 9.22.3; 9.24.1.5; 9.20.4.22; 9.24.1.9; 9.20.4.28; 9.16.4.92; 9.18.4.135; 9.23.1.195; 9.20.4.30; 9.24.1.155; 9.23.1.32; 9.18.4.82
- Cisco Cisco Secure Firewall Threat Defense (FTD) Software: affected 7.0.0; 7.0.0.1; 7.0.1; 7.0.1.1; 7.0.2; 7.2.0; 7.0.2.1; 7.0.3; 7.2.0.1; 7.0.4; 7.2.1; 7.0.5; 7.3.0; 7.2.2; 7.2.3; 7.3.1; 7.2.4; 7.0.6; 7.2.5; 7.2.4.1; 7.3.1.1; 7.4.0; 7.0.6.1; 7.2.5.1; 7.4.1; 7.2.6; 7.0.6.2; 7.4.1.1; 7.2.7; 7.2.5.2; 7.3.1.2; 7.2.8; 7.6.0; 7.4.2; 7.2.8.1; 7.0.6.3; 7.4.2.1; 7.2.9; 7.0.7; 7.7.0; 7.4.2.2; 7.2.10; 7.6.1; 7.4.2.3; 7.0.8; 7.6.2; 7.7.10; 7.7.11; 7.0.8.1; 7.6.2.1; 7.7.10.1; 7.4.2.4; 7.2.10.2; 7.4.3; 7.6.4; 10.0.0; 7.4.4; 7.0.9; 7.2.11; 7.4.7

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated remote attacker can send a crafted IKEv2 certificate to crash IKEv2 process and reload the device, causing network/perimeter DoS.

## Action

Immediate action required

## Recommendation

Apply Cisco advisory mitigations and updates ASAP; restrict/inspect IKEv2 from untrusted networks.

## References

- [other] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ikev2cert-dos-uWyc2xtv

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.