CVE-2026-20154Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software Logging Denial of Service

Description

A vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause high CPU utilization on an affected device, resulting in a denial of service (DoS) condition. This vulnerability is due to improper rate limiting for syslog message 419002. An attacker could exploit this vulnerability by sending a flood of TCP synchronization (SYN) packets to an affected device. A successful exploit could allow the attacker to cause high CPU utilization, resulting in performance degradation. 

Timeline

Scores

EPSS (exploitation in 30 days)

0.57% · top 52% of all CVEs (14 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.6.

Affected products

• Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software

  • affected 9.16.1
  • affected 9.16.1.28
  • affected 9.16.2
  • affected 9.16.2.3
  • affected 9.16.2.7
  • affected 9.16.2.11
  • affected 9.16.2.13
  • affected 9.16.2.14
  • affected 9.16.3.3
  • affected 9.16.3
  • affected 9.16.3.14
  • affected 9.18.1
  • affected 9.16.3.15
  • affected 9.18.1.3
  • affected 9.18.2
  • affected 9.16.3.19
  • affected 9.16.3.23
  • affected 9.18.2.5
  • affected 9.16.4
  • affected 9.18.2.7
  • affected 9.19.1
  • affected 9.16.4.9
  • affected 9.18.2.8
  • affected 9.16.4.14
  • affected 9.18.3
  • affected 9.19.1.5
  • affected 9.16.4.18
  • affected 9.19.1.9
  • affected 9.18.3.39
  • affected 9.16.4.19
  • affected 9.19.1.12
  • affected 9.18.3.46
  • affected 9.16.4.27
  • affected 9.19.1.18
  • affected 9.18.3.53
  • affected 9.18.3.55
  • affected 9.16.4.38
  • affected 9.16.4.39
  • affected 9.18.3.56
  • affected 9.20.1
  • and 70 more

• Cisco · Cisco Secure Firewall Threat Defense (FTD) Software

  • affected 7.0.0
  • affected 7.0.0.1
  • affected 7.0.1
  • affected 7.0.1.1
  • affected 7.0.2
  • affected 7.2.0
  • affected 7.0.2.1
  • affected 7.0.3
  • affected 7.2.0.1
  • affected 7.0.4
  • affected 7.2.1
  • affected 7.0.5
  • affected 7.3.0
  • affected 7.2.2
  • affected 7.2.3
  • affected 7.3.1
  • affected 7.2.4
  • affected 7.0.6
  • affected 7.2.5
  • affected 7.2.4.1
  • affected 7.3.1.1
  • affected 7.4.0
  • affected 7.0.6.1
  • affected 7.2.5.1
  • affected 7.4.1
  • affected 7.2.6
  • affected 7.0.6.2
  • affected 7.4.1.1
  • affected 7.2.7
  • affected 7.2.5.2
  • affected 7.3.1.2
  • affected 7.2.8
  • affected 7.6.0
  • affected 7.4.2
  • affected 7.2.8.1
  • affected 7.0.6.3
  • affected 7.4.2.1
  • affected 7.2.9
  • affected 7.0.7
  • affected 7.7.0
  • and 16 more

What to do

Exploitation: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-81128 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-20154](https://cveledger.app/badge/CVE-2026-20154.svg)](https://cveledger.app/cve/CVE-2026-20154)

Record last updated 18 Sept 2026, 19:09 UTC.