CISCO Security Advisory
Published Date: Not specified
CVE: CVE-2026-20135
Advisory Summary
💡➡️ ⛔ Cisco Secure Firewall Threat Defense: TLS 1.3 DoS via LINA Crash (CVE-2026-20135)
⚠️ Alarm: High severity availability risk (remote, unauthenticated)
Cisco reports a vulnerability in the TLS 1.3 implementation within Cisco Secure Firewall Threat Defense (FTD) Software that could let an attacker cause the device to reload unexpectedly, resulting in a Denial of Service (DoS) condition.
- Root cause: improper buffer management during TLS 1.3 connection handling.
- Attack vector: an unauthenticated remote adversary sends a crafted TLS 1.3 packet to a TLS 1.3-enabled listening socket.
- Exploitation effect: the LINA process crashes, triggering a reload.
- Timing: the reload may occur before or after authentication.
- data traffic, and
- user-management traffic
- No workarounds are provided by Cisco for this issue.
- Apply Cisco’s released software updates addressing CVE-2026-20135 across affected Secure Firewall FTD deployments.
- Review whether any external-facing interfaces/services expose TLS 1.3-enabled listening sockets relevant to FTD.
- Since the outcome is a device reload, plan patching/maintenance to minimize downtime and reduce incident risk.
- Strengthen monitoring/alerting for LINA crashes and unexpected reload events, correlating with TLS traffic spikes.
📎
.3
Reference: Vendor Advisory