Known vulnerabilities in Cisco Adaptive Security Appliance (ASA)

Software CPE: cpe:2.3:h:cisco_systems:asa:*:*:*:*:*:*:*:*
Total vulnerabilities: 144
Public exploits: 7
Known exploited (KEV): 11
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Cisco Adaptive Security Appliance (ASA) Cisco Adaptive Security Appliance (ASA) is affected by 144 known vulnerabilities: 2 critical, 22 high, 87 medium, 33 low Critical High Medium Low

Vulnerabilities (144)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU141542 - Improper Clearing of Heap Memory Before Release ('Heap Inspection')
CVE-2026-20349
CWE-244 High
No
Exploited
9.16 89.18.4.50, 9.18 89.18.4.50, 9.20.4.235, 9.22.3.191, 9.23.1.211, 9.24.1.221 12.08.2026 SB2026081227
#VU124595 - Missing release of memory after effective lifetime
CVE-2026-20012
CWE-401 Medium
No
No
9.16.4.85, 9.18.4.71, 9.20.4.10, 9.22.2.13, 9.23.1.19 25.03.2026 SB20260325183
#VU123678 - Argument Injection or Modification
CVE-2026-20016
CWE-88 Low
No
No
9.16.4.89, 9.18.4.71, 9.20.4.19, 9.22.2.20, 9.23.1.26, 9.24.1 10.03.2026 SB2026031047
#VU123662 - Improper input validation
CVE-2026-20025
CWE-20 Low
No
No
9.16.4.85, 9.18.4.71, 9.20.4.10, 9.22.2.13, 9.23.1.19, 9.24.1 10.03.2026 SB2026031001
#VU123661 - Heap-based Buffer Overflow
CVE-2026-20024
CWE-122 Low
No
No
9.16.4.84, 9.18.4.57, 9.19.1.42, 9.20.3.20, 9.20.4, 9.22.2, 9.23.1.3, 9.24.1 10.03.2026 SB2026031001
#VU123659 - Out-of-bounds write
CVE-2026-20022
CWE-787 Medium
No
No
9.16.4.89, 9.18.4.71, 9.20.4.19, 9.22.2.20, 9.23.1.26, 9.24.1 09.03.2026 SB2026031001
#VU123657 - Memory corruption
CVE-2026-20020
CWE-119 Low
No
No
9.16.4.89, 9.18.4.66, 9.20.4, 9.22.2.4, 9.23.1.7, 9.24.1 09.03.2026 SB2026031001
#VU123656 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-20102
CWE-79 Low
No
No
9.16.4.89, 9.18.4.71, 9.20.4.19, 9.22.2.32, 9.23.1.26, 9.24.1 09.03.2026 SB2026030966
#VU123655 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-20070
CWE-79 Low
No
No
9.16.4.89, 9.18.4.71, 9.20.4.14, 9.22.2.20, 9.23.1.22, 9.24.1 09.03.2026 SB2026030965
#VU123652 - Improper Access Control
CVE-2026-20073
CWE-284 Medium
No
No
9.16.4.85, 9.18.4.71, 9.20.4.14, 9.22.2.14, 9.23.1.22, 9.24.1 09.03.2026 SB2026030960
#VU123651 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2026-20069
CWE-444 Medium
No
No
9.16.4.85, 9.18.4.66, 9.20.4.7, 9.22.2.13, 9.23.1.13, 9.24.1 09.03.2026 SB2026030959
#VU123618 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-20008
CWE-78 Low
No
No
9.16.4.85, 9.18.4.66, 9.20.4, 9.22.2.4, 9.23.1.7, 9.24.1 06.03.2026 SB2026030648
#VU123563 - Improper Neutralization of Special Elements
CVE-2026-20009
CWE-138 Medium
No
No
9.18.4.71, 9.20.4.10, 9.22.2.14, 9.23.1.19 05.03.2026 SB2026030524
#VU117302 - Buffer Access with Incorrect Length Value
CVE-2025-20360
CWE-805 Medium
No
No
- 15.10.2025 SB20251015158
SB20251015159
SB20251015160
and 2 more
#VU117301 - Buffer Under-read
CVE-2025-20359
CWE-127 Medium
No
No
- 15.10.2025 SB20251015157
SB20251015159
SB20251015160
and 2 more
#VU116120 - Heap-based Buffer Overflow
CVE-2025-20363
CWE-122 Critical
No
No
9.16.4.84, 9.18.4.57, 9.19.1.42, 9.20.3.16, 9.22.2, 9.23.1.3 25.09.2025 SB2025092573
SB2025092574
SB2025092575
#VU116119 - Buffer overflow
CVE-2025-20333
CWE-120 High
No
Exploited
9.16.4.85, 9.17.1.45, 9.18.4.47, 9.19.1.37, 9.20.3.7, 9.22.1.3 25.09.2025 SB2025092570
#VU116118 - Missing Authorization
CVE-2025-20362
CWE-862 High
No
Exploited
- 25.09.2025 SB2025092566
#VU114759 - Improper Resource Shutdown or Release
CVE-2025-20127
CWE-404 Medium
No
No
9.20.3.10, 9.22.1.3, 9.22.2.4 03.09.2025 SB2025090339
#VU114228 - Double Free
CVE-2025-20134
CWE-415 Medium
No
No
9.16 19.08.2025 SB2025081957


Showing elements 1 - 20 out of 144