CVE-2026-20222
HIGH 7.4 ALL-YEARSA vulnerability in the EIGRP implementation in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, adjacent attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper resource management when handling EIGRP update messages. An attacker could exploit this vulnerability by sending crafted EIGRP updates at a high rate to an affected device. A successful exploit could allow the attacker to trigger a memory leak that will eventually cause the affected device to reload unexpectedly.
Severe if exploited (CVSS 7.4), but no confirmed exploitation. Patch on a normal cadence.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 6th percentile
Impact if exploited
7.4CVSS 3.1 · HIGH · CNA
- ConfidentialityNone
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ⚠Access: Must sit on the same / adjacent network
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept & exploit code
No public exploit or proof-of-concept code is catalogued for this CVE (no ExploitDB, Nuclei, or CISA-KEV entry). It may still exist — search GitHub or check the references below.
Affected
Vendors Cisco
Products Cisco Secure Firewall Adaptive Security Appliance (Asa) Software Cisco Secure Firewall Threat Defense (Ftd) Software
Weakness (CWE)
- CWE-401: Missing Release of Memory after Effective Lifetime
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
All CVSS metrics
- HIGH 7.4 v3.1 · CNA Primary
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - HIGH 7.4 v3.1 · NVD Secondary
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H