Double free in Cisco Secure Firewall Threat Defense (FTD) - CVE-2026-20135
Published: September 17, 2026
Vulnerability identifier: #VU150687
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-20135
CWE-ID: CWE-415
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in the TLS 1.3 implementation. A remote attacker can send a specially crafted TLS 1.3 packet, trigger double free error and causea denial of service condition on the target system.
Affected software
Cisco Secure Firewall Threat Defense (FTD)
How to mitigate CVE-2026-20135
Install updates from vendor's website.
Cisco Secure Firewall Threat Defense (FTD) - addressed in versions 7.0.10, 7.2.12, 7.4.7, 7.4.8, 7.6.6, 7.7.13, 10.0.0, 10.0.2