# CVE-2026-20250

Unauthenticated DTLS packets can force Cisco ASA/FTD reloads (DoS).

- Page: https://www.vulneraibility.com/cve/CVE-2026-20250
- CVSS: 8.6
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.57% (percentile 47.4)
- CISA SSVC: exploitation none, automatable yes, technical impact partial (assessed 2026-09-17)
- Weakness: CWE-772
- Published: 2026-09-16

## Affected versions

- Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software: affected 9.23.1; 9.22.1.1; 9.22.1.3; 9.22.1.6; 9.22.2; 9.23.1.3; 9.22.2.4; 9.23.1.7; 9.22.2.9; 9.23.1.13; 9.22.2.13; 9.23.1.19; 9.22.2.14; 9.24.1; 9.23.1.22; 9.22.2.20; 9.23.1.26
- Cisco Cisco Secure Firewall Threat Defense (FTD) Software: affected 7.6.0; 7.7.0; 7.6.1; 7.6.2; 7.7.10; 7.7.11; 7.6.2.1; 7.7.10.1; 7.6.4; 10.0.0

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote unauthenticated attacker can send crafted DTLS traffic to trigger device reloads, causing firewall outage and network disruption.

## Action

Immediate action required

## Recommendation

Apply Cisco mitigations, block/uninspect DTLS from untrusted sources, restrict access, install vendor updates when published.

## References

- [other] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-dtls-dos-Kp57HkyO

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.