CVE-2026-20102Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software SAML Reflected Cross-Site Scripting Vulnerability
Updated under an hour ago ()
Does this affect you?
It affects Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and 3 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the SAML feature and access sensitive, browser-based information. This vulnerability is due to insufficient input validation of multiple HTTP parameters. An attacker could exploit this vulnerability by persuading a user to access a malicious link. A successful exploit could allow the attacker to conduct a reflected XSS attack through an affected device.
- CVSS
- 6.1 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness (CWE)
- CWE-79
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- cisco
- NVD analysis
- Analyzed
- Record last updated
- Mar 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software cisco:secure_firewall_adaptive_security_appliance_asa_software (from the name) | 9.16.1; 9.16.1.28; 9.16.2; 9.16.2.3; 9.16.2.7; 9.17.1; 9.16.2.11; 9.16.2.13; and 20 more ranges | CNA record |
Cisco Cisco Secure Firewall Threat Defense (FTD) Software cisco:secure_firewall_threat_defense_ftd_software (from the name) | 7.0.0; 7.0.0.1; 7.0.1; 7.1.0; 7.0.1.1; 7.1.0.1; 7.1.0.2; 7.1.0.3 | CNA record |
cisco adaptive_security_appliance_software cisco:adaptive_security_appliance_software | from 9.16.1 before 9.16.4.89; from 9.17.1 before 9.18.4.71; from 9.20.1 before 9.20.4.19; from 9.22.1.1 before 9.22.2.32; from 9.23.1 before 9.23.1.26 | NVD |
cisco secure_firewall_threat_defense cisco:secure_firewall_threat_defense | from 7.0.0 before 7.0.9; from 7.1.0 before 7.2.11; from 7.4.0 before 7.4.3; from 7.6.0 before 10.0.0 | NVD |
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-saml-LktTrwZPvendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.