CISCO Security Advisory
Published Date: Not specified
CVE: CVE-2026-20249
Advisory Summary
🗓️ Calendar • Sep 18, 2026
📌 🔔 Cisco Secure Firewall ASA/FTD IKEv2 Certificate Auth DoS (High Severity)
🚨 Alarm: A High-impact vulnerability has been disclosed in IKEv2 certificate authentication used by Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software. A remote, unauthenticated attacker can trigger an unexpected device reload by exploiting a logic error during certificate-based IKEv2 connection setup.
- The attacker attempts to establish an IKEv2 VPN session using a crafted certificate.
- If successful, the IKEv2 process crashes, resulting in a Denial of Service (DoS) condition (including unexpected reload).
- IKEv2 certificate authentication phase in Cisco Secure Firewall ASA and FTD.
- Cisco has released software updates to remediate the issue.
- No workarounds are available, meaning mitigation depends on patching/upgrading.
🎯 Action Plan (What market professionals should do now):
1. Identify exposure: inventory all deployed Cisco Secure Firewall ASA/FTD versions and verify whether they’re affected by CVE-2026-20249.
2. Patch immediately: schedule installation of the Cisco-provided updates per the advisory guidance.
3. Validate failover/availability: confirm HA behavior and operational readiness, since the symptom can be reload/DoS.
4. Harden VPN access paths: review perimeter controls around IKEv2/VPN endpoints (even though no workaround exists, layered defenses can reduce exploit attempts reaching the device).
5. Monitor for IKEv2 instability: track reload events, IKEv2 process failures, and VPN negotiation anomalies during/after change windows.
🔐
-2026-20249
Reference: Vendor Advisory