PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-20102 Cisco CVE debrief

A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the SAML feature and access sensitive, browser-based information. This vulnerability is due to insufficient input validation of multiple HTTP parameters. An attacker could exploit this vulnerability by persuading a user to access a malicious link. A successful exploit could allow the attacker to conduct a reflected XSS attack through an affected device.

Vendor
Cisco
Product
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-04
Original CVE updated
2026-08-11
Advisory published
2026-03-04
Advisory updated
2026-08-11

Who should care

Administrators and users of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software should be aware of this vulnerability and take necessary precautions to mitigate it. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability details and assess their exposure. They should also plan for vendor-supported updates or mitigations and implement compensating controls if necessary.

Technical summary

The vulnerability is due to insufficient input validation of multiple HTTP parameters in the SAML 2.0 SSO feature of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software. An attacker could exploit this vulnerability by persuading a user to access a malicious link, allowing the attacker to conduct a reflected XSS attack through an affected device. The vulnerability has a CVSS score of 6.1 and is classified as MEDIUM severity.

Defensive priority

Medium-priority defensive actions are required to address this vulnerability.

Recommended defensive actions

  • Apply patches or updates provided by Cisco to address the vulnerability
  • Implement additional security measures, such as input validation and sanitization
  • Monitor systems for suspicious activity
  • Restrict access to sensitive information
  • Conduct regular security audits and vulnerability assessments

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its description, CVSS score, and affected products. A vendor advisory is available for mitigation. Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software are affected. The SAML 2.0 SSO feature is impacted. The vulnerability allows for reflected XSS attacks. Defenders should verify affected product deployments, review official advisories, and plan for vendor-supported updates or mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-20102 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-20102

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-20102 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-20102

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.