A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access controls.

This vulnerability is due to a logic error in populating group access control policies (ACPs) with OGS configured. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00487.

Exploitation none

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software unknown
Version Status Constraints
9.23.1 affected —
9.22.1.1 affected —
9.22.1.3 affected —
9.22.1.2 affected —
9.22.1.6 affected —
9.22.2 affected —
9.23.1.3 affected —
9.22.2.4 affected —
9.23.1.7 affected —
9.22.2.9 affected —
9.23.1.13 affected —
9.22.2.13 affected —
9.23.1.19 affected —
9.22.2.14 affected —
9.23.1.22 affected —
9.22.2.20 affected —
Cisco Cisco Secure Firewall Threat Defense (FTD) Software unknown
Version Status Constraints
7.6.0 affected —
7.7.0 affected —
7.6.1 affected —
7.6.2 affected —
7.7.10 affected —
7.7.11 affected —
7.6.2.1 affected —
7.7.10.1 affected —

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-acl-bypass-8p6vFvw cve-icon cve-icon
History

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Description A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access controls. This vulnerability is due to a logic error in populating group access control policies (ACPs) with OGS configured. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks.
Title CIsco FTD Bypass Access List
Weaknesses CWE-284
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-09-17T15:56:48.183Z

Reserved: 2025-10-08T11:59:15.377Z

Link: CVE-2026-20121

cve-icon Vulnrichment

Updated: 2026-09-17T15:56:42.947Z

cve-icon NVD

Status : Received

Published: 2026-09-16T21:17:07.467

Modified: 2026-09-17T16:17:23.800

Link: CVE-2026-20121

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses