Vulnerabilities
Cisco ASA/FTD DTLS DoS Vulnerability (CVE‑2026‑20250) – Immediate Patch Required
Cisco’s Adaptive Security Appliance (ASA) and Threat Defense (FTD) software for the 3100 and 4200 series can be forced into a denial‑of‑service state by an unauthenticated attacker sending crafted DTLS traffic. The flaw stems from improper resource handling during DTLS message processing, causing a device reload. Cisco has issued patches and workarounds; applying the update is essential to keep firewalls online.
What’s at stake
An unauthenticated remote attacker can trigger a device reboot on ASA and FTD firewalls by flooding them with malicious DTLS packets. The resulting reboot leaves the firewall offline, disrupting network traffic and potentially exposing the organization to further attacks.
How the flaw works
The vulnerability lies in DTLS message handling where resource limits are not correctly enforced. When the firewall receives a specially crafted stream of DTLS packets, it exhausts internal buffers, forces a reload, and drops connectivity.
Affected devices
- ASA Software on Cisco Secure Firewall 3100 Series
- ASA Software on Cisco Secure Firewall 4200 Series
- FTD Software on Cisco Secure Firewall 3100 Series
- FTD Software on Cisco Secure Firewall 4200 Series
Mitigation steps
- Install the latest Cisco firmware updates that address CVE‑2026‑20250.
- If immediate patching isn’t possible, apply the documented workarounds to mitigate the risk.
- Block or rate‑limit DTLS traffic at the network perimeter until a patch is applied.
Patch status
Cisco has released software updates for all affected ASA and FTD models. The advisory recommends prompt deployment of these fixes to eliminate the DoS vector. Keep your devices updated and monitor Cisco’s security portal for any additional guidance.
Related vulnerabilities
StrongSwan Remote DoS Vulnerability (CVE‑2026‑78123) – Immediate Patching Required
A critical remote denial‑of‑service flaw has been discovered in StrongSwan VPN software, identified as CVE‑2026‑78123. The vulnerability allows attackers to crash the daemon on any system running a version older than 6.1.0, potentially taking networks offline. It is triggered by malformed IKE packets and can be mitigated by applying the vendor‑released patch. All affected deployments should update immediately.
Read briefing
SAP Exposes Critical Kernel & Message Server Flaws: CVE-2026-44756 & CVE-2026-58240
SAP’s September Security Patch Day revealed two critical vulnerabilities that can be exploited remotely without authentication. The memory‑corruption flaw in SAP Extended Passport (OVERPASS, CVE‑2026‑44756) and the missing‑auth bug in NetWeaver Message Server (S4GET, CVE‑2026‑58240) both allow attackers to run arbitrary OS commands as the SAP installation user, risking full system takeover. Immediate application of SAP Security Notes 3747649 and 3759472 is mandatory.
Read briefing
Wärtsilä FOS‑Onboard Faces Dual Hard‑Coded Key Vulnerabilities (CVE‑2026‑78225, CVE‑2026‑81855)
Two critical CVEs expose hard‑coded cryptographic keys in Wärtsilä FOS‑Onboard 5.07.0923.01, allowing attackers to push unauthorized updates, execute code or steal credentials. With a CVSS score of 9.1, the flaws threaten transportation‑system operators worldwide. Wärtsilä has released a patch; users must contact the vendor to apply it immediately.
Read briefing
Cisco IMC Web Interface XSS Exploit Enables Remote Script Execution – CVE‑2026‑20198
A newly disclosed cross‑site scripting flaw in Cisco’s Integrated Management Controller (IMC) web UI allows an authenticated, remote attacker to inject malicious code into a victim’s browser. By luring a logged‑in user to click a crafted link, the attacker can execute arbitrary scripts or steal browser‑based data. Cisco has released patches; no work‑arounds are available. The vulnerability carries a Medium impact rating and is tracked as CVE‑2026‑20198.
Read briefing