PT-2026-6079 · Cisco · Cisco Asyncos+1

Published 2026-02-04 · Updated 2026-02-04 · CVE-2026-20056

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco AsyncOS Software for Cisco Secure Web Appliance (affected versions not specified)

Description A flaw in the Dynamic Vectoring and Streaming (DVS) Engine implementation may allow a remote, unauthenticated attacker to circumvent the anti-malware scanner. This bypass enables the download of malicious archive files. The issue stems from improper handling of specific archive files. An attacker could exploit this by transmitting a specially crafted archive file through an affected device. Successful exploitation could result in the attacker bypassing the anti-malware scanner and downloading malware to an end user's workstation. The malware will not execute automatically unless the user extracts and runs the malicious file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-494

Related Identifiers

BDU:2026-02640

CVE-2026-20056

Affected Products

Cisco Asyncos

Cisco Secure Web Appliance

References · 4

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-archive-bypass-Scx2e8zF · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02640 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-20056 · Security Note
• https://t.me/CVEtracker/43723 · Telegram Post