Cisco Security Advisories guidance
Vendor revision: Sep 18, 2026Cisco has released software updates that address this vulnerability.
Overview
What is CVE-2026-20249?
A vulnerability in the certification authentication feature of Internet Key Exchange version 2 (IKEv2) for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly.
This vulnerability is due to a logic error during the certificate authentication phase of the IKEv2 connection setup. An attacker could exploit this vulnerability by attempting to establish an IKEv2 VPN connection with a crafted certificate.
A successful exploit could allow the attacker to cause the IKEv2 process to crash, causing a denial of service (DoS) condition.
Source: NVD
Official advisory
Configuration and update guidance
Cisco Security Advisories · Updated Sep 18, 2026
Affected products and configuration
This vulnerability affects Cisco Secure Firewall ASA Software and Secure FTD Software if they have the IKEv2 VPN feature enabled with certificate authentication.
For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.
Determine the Software Configuration
To determine whether IKEv2 is enabled on Cisco Secure Firewall ASA Software or Secure FTD Software, use the show running-config crypto ikev2 | include enable CLI command. If that command returns output, IKEv2 is enabled on at least one interface. The following example shows the output on a device that has IKEv2 enabled on the outside interface:
firewall# show running-config crypto ikev2 | include enable crypto ikev2 enable outside client-services port 443
If the command returns empty output, the device is not affected by this vulnerability.
To determine whether IKEv2 is configured for certificate authentication on Cisco Secure Firewall ASA Software or Secure FTD Software, use the show running-config crypto ikev2 | include trust CLI command, as shown in the following example:
firewall# show running-config crypto ikev2 | include trust crypto ikev2 remote-access trustpoint VPN-Cert
If the command returns empty output, the device is not affected by this vulnerability.
If IKEv2 is enabled and a trustpoint certificate is configured, the device is affected by this vulnerability.
Workarounds and temporary mitigations
There are no workarounds that address this vulnerability.
Fixed software
Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.
Fixed Releases
In the following table, the left column lists Cisco software releases. The center column lists hot fixes that are affected by the vulnerabilities that are described in this advisory, and the right column indicates the first software release that includes the fix for these vulnerabilities. Customers who installed one of the listed hot fix releases must install the listed first fixed release.
Cisco Secure Firewall ASA Software Release | Affected Hot Fix Release | First Fixed Release |
|---|---|---|
9.16 and earlier | N/A | 9.16.4.103 |
9.18 | 9.18.4.135 | 9.18.4.94 |
9.20 | 9.20.4.235 | 9.20.4.49 |
9.22 | 9.22.3.191 | 9.22.3.26 |
9.23 | 9.23.1.195 9.23.1.211 | 9.23.1.47 |
9.24 | 9.24.1.155 9.24.1.221 | 9.24.1.26 |
In the following table, the left column lists Cisco software releases. The right column indicates whether a release is affected by the vulnerabilities that are described in this advisory and the first release that includes the fix for these vulnerabilities.
Cisco Secure FTD Software Release and Secure FMC Software Release | First Fixed Release |
|---|---|
7.0 and earlier | 7.0.10 |
7.2 | 7.2.12 |
7.4 | 7.4.8 |
7.6 | 7.6.6 |
7.7 | 7.7.13 |
10.0 | 10.0.2 |
10.1 | 10.1.0 |
Cisco strongly recommends that customers upgrade to the first fixed releases in the preceding tables because they include fixes for multiple vulnerabilities. For more information, see Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software Hardening Release: September 2026.
Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software
To help customers determine their exposure to vulnerabilities in Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software, Cisco provides the Cisco Software Checker. This tool identifies any Cisco security advisories that impact a specific software release and the earliest release that fixes the vulnerabilities that are described in each advisory (“First Fixed”).
If applicable, the tool also returns the earliest release that fixes all the vulnerabilities that are described in all the advisories that the Software Checker identifies (“Combined First Fixed”).
To use the tool, go to the Cisco Software Checker page and follow the instructions. Alternatively, use the following form to search for vulnerabilities that affect a specific software release. To use the form, follow these steps:
Choose which advisories the tool will search-all advisories, only advisories with a Critical or High Security Impact Rating (SIR), or only this advisory.
Choose the appropriate software.
Choose the appropriate platform.
Enter a release number-for example, 9.20.3.4 for Cisco Secure Firewall ASA Software or 7.4.2 for Cisco Secure FTD Software.
Click Check.
Additional Resources
For help determining the best Cisco Secure Firewall ASA, Secure FMC, or Secure FTD Software release, see the following Recommended Releases documents. If a security advisory recommends a later release, Cisco recommends following the advisory guidance.
Cisco Secure Firewall ASA Compatibility
Cisco Secure Firewall ASA Upgrade Guide
Cisco Secure Firewall Threat Defense Compatibility Guide
Exploitation status
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.