PT-2026-33089 · Cisco · Asyncos

Published 2026-04-15 · Updated 2026-04-16 · CVE-2026-20152

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco AsyncOS Software for Cisco Secure Web Appliance (affected versions not specified)

Description An issue in the authentication service feature allows an unauthenticated remote attacker to bypass authentication policy requirements. This is caused by improper validation of user-supplied authentication input in HTTP requests. By sending specific authentication requests, an attacker can bypass policy enforcement, enabling the transmission of HTTP requests that should otherwise be restricted by the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-305

Related Identifiers

BDU:2026-05637

CVE-2026-20152

Affected Products

Asyncos

References · 5

• https://bdu.fstec.ru/vul/2026-05637 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-20152 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-auth-bypass-6YZkTQhd · Vendor Advisory
• https://twitter.com/CVEnew/status/2044737960264777731 · Twitter Post
• https://twitter.com/romanaegis/status/2044850125353492695 · Twitter Post