Cisco · Cisco Secure Firewall Asa · CVE-2026-20069
**Name of the Vulnerable Software and Affected Versions**
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software (affected versions not specified)
**Description**
A flaw exists in the VPN web services component that may allow a remote attacker to carry out browser-based attacks against users of an affected device. This is caused by inadequate validation of HTTP requests. An attacker could exploit this by convincing a user to visit a malicious website designed to send harmful HTTP requests to a device running the software with VPN web services enabled. A successful exploit could allow the attacker to reflect malicious input to the user's browser, potentially leading to attacks like cross-site scripting (XSS). The attacker cannot directly impact the affected device.
**Recommendations**
At the moment, there is no information about a newer version that contains a fix for this vulnerability.