PT-2026-22970 · Cisco · Cisco Secure Firewall Asa

T.Ve · Published 2026-03-04 · Updated 2026-03-04 · CVE-2026-20009

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (affected versions not specified)

Description A flaw exists in the proprietary SSH stack with SSH key-based authentication in Cisco Secure Firewall ASA Software. This issue could allow a remote attacker to log in to a Cisco Secure Firewall ASA device and execute commands as a specific user without the user's private SSH key. The vulnerability stems from inadequate validation of user input during the SSH authentication process. An attacker can exploit this by providing crafted input during SSH authentication. To successfully exploit this, the attacker must have a valid username and the corresponding public key. Exploitation does not grant root access. The AAA configuration command auto-enable is not impacted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-138

Related Identifiers

CVE-2026-20009

Affected Products

Cisco Secure Firewall Asa

References · 3

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssh-keybypass-cr5xPUSf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-20009 · Security Note
• https://twitter.com/CVEnew/status/2029272826394399015 · Twitter Post