Cisco Patches Critical Flaws in Secure Firewall ASA and Threat Defense Software
The Dutch National Cyber Security Centre (NCSC) published advisory NCSC-2026-0458 on 28 October 2026, disclosing multiple vulnerabilities in Cisco Secure Firewall ASA, Threat Defense, and Management Center software products. Cisco has addressed these issues by grouping them into eight distinct vulnerability classes, assigning a single CVE identifier to each group. The flaws encompass insufficient access control, incorrect input processing, security mechanism errors, and improper exception handling. Four of the eight CVEs carry a CVSS score of 9.0 or higher, indicating critical severity.
Among the highest-rated flaws, CVE-2026-20329 and CVE-2026-20330 both received a CVSS score of 9.9. These vulnerabilities allow network-based exploitation by users with limited privileges and without requiring user interaction. Two other significant flaws, CVE-2026-20331 and CVE-2026-20332, scored 9.6 and 9.0 respectively, relating to deficiencies in security mechanisms and access control.
Cisco reports that two access control vulnerabilities are currently being actively exploited. These are previously published flaws, CVE-2026-20079 and CVE-2026-20316, located in Cisco Secure FMC. Exploitation of these specific issues can lead to authentication bypass and unauthorized access using static login credentials. The NCSC had already issued separate advisories for these two specific vulnerabilities prior to this consolidated release.
For the remaining vulnerabilities included in this hardening release, Cisco states there is no known active exploitation. Organizations managing Cisco firewall infrastructure should review the NCSC advisory and apply the relevant patches to mitigate the risk of network-based attacks and privilege escalation.