CVE-2026-20154
HIGH 8.6 ALL-YEARSA vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause high CPU utilization on an affected device, resulting in a denial of service (DoS) condition. This vulnerability is due to improper rate limiting for syslog message 419002. An attacker could exploit this vulnerability by sending a flood of TCP synchronization (SYN) packets to an affected device. A successful exploit could allow the attacker to cause high CPU utilization, resulting in performance degradation.
Severe if exploited (CVSS 8.6), but no confirmed exploitation. Patch on a normal cadence.
Exploitation likelihood
0.4%chance of exploitation in 30 days · 33rd percentile
Impact if exploited
8.6CVSS 3.1 · HIGH · CNA
- ConfidentialityNone
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept & exploit code
No public exploit or proof-of-concept code is catalogued for this CVE (no ExploitDB, Nuclei, or CISA-KEV entry). It may still exist — search GitHub or check the references below.
Affected
Vendors Cisco
Products Cisco Secure Firewall Adaptive Security Appliance (Asa) Software Cisco Secure Firewall Threat Defense (Ftd) Software
Weakness (CWE)
- CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
All CVSS metrics
- HIGH 8.6 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - HIGH 8.6 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H