CISCO Security Advisory
Published Date: Not specified
CVE: CVE-2026-20120
Advisory Summary
🗓️ Calendar: September 18, 2026
🔷 Object Group Search (OGS) → ACL Bypass in Cisco Secure Firewall (ASA/FTD)
Cisco reports multiple logic errors in how ACL Object Group Search (OGS) group access control policies (ACPs) are populated within Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software.
- An unauthenticated remote attacker may be able to bypass configured access controls.
- Exploitation could allow traffic that should be blocked to be processed, potentially enabling access to protected network resources.
- A logic flaw causes incorrect application of group access control policies when OGS is configured.
- Attackers leverage crafted traffic patterns that interact with the affected ACL/OGS processing path.
- ✅ Software updates are available that address the vulnerabilities.
- ❌ No workarounds are provided.
- CVE-2026-20120
- CVE-2026-20121
🚨 Market/operations actions (recommended now)
1. Identify affected deployments: ASA/FTD versions using ACL with OGS configuration.
2. Plan patching immediately: prioritize devices with internet exposure or where ACL policy enforcement is security-critical.
3. Validate control integrity post-update: confirm blocked flows remain blocked (especially those relying on OGS-based group membership).
4. Review similar policy logic across related objects/configs to reduce the chance of adjacent mis-enforcement.
# #