---
id: CVE-2026-20120
title: >-
  A vulnerability in the access control list (ACL) Object Group Search (OGS)
  implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA)
  Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow
  an unauthen…
summary: >-
  A vulnerability in the access control list (ACL) Object Group Search (OGS)
  implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA)
  Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow
  an unauthen…
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N'
cwe:
  - CWE-284
vendor: Cisco
product: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
affected:
  - secure_firewall_adaptive_security_appliance_asa_software 9.23.1
  - secure_firewall_adaptive_security_appliance_asa_software 9.22.1.1
  - secure_firewall_adaptive_security_appliance_asa_software 9.22.1.3
  - secure_firewall_adaptive_security_appliance_asa_software 9.22.1.2
  - secure_firewall_adaptive_security_appliance_asa_software 9.22.1.6
  - secure_firewall_adaptive_security_appliance_asa_software 9.22.2
  - secure_firewall_adaptive_security_appliance_asa_software 9.23.1.3
  - secure_firewall_adaptive_security_appliance_asa_software 9.22.2.4
  - secure_firewall_adaptive_security_appliance_asa_software 9.23.1.7
  - secure_firewall_adaptive_security_appliance_asa_software 9.22.2.9
  - secure_firewall_adaptive_security_appliance_asa_software 9.23.1.13
  - secure_firewall_adaptive_security_appliance_asa_software 9.22.2.13
  - secure_firewall_adaptive_security_appliance_asa_software 9.23.1.19
  - secure_firewall_adaptive_security_appliance_asa_software 9.22.2.14
  - secure_firewall_adaptive_security_appliance_asa_software 9.23.1.22
  - secure_firewall_adaptive_security_appliance_asa_software 9.22.2.20
  - secure_firewall_threat_defense_ftd_software 7.6.0
  - secure_firewall_threat_defense_ftd_software 7.7.0
  - secure_firewall_threat_defense_ftd_software 7.6.1
  - secure_firewall_threat_defense_ftd_software 7.6.2
  - secure_firewall_threat_defense_ftd_software 7.7.10
  - secure_firewall_threat_defense_ftd_software 7.7.11
  - secure_firewall_threat_defense_ftd_software 7.6.2.1
  - secure_firewall_threat_defense_ftd_software 7.7.10.1
published: '2026-09-16'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T13:28:28.567'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-20120'
references:
  - url: >-
      https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-acl-bypass-8p6vFvw
    label: psirt@cisco.com
  - url: 'https://software.cisco.com'
tags:
  - nvd
  - cve.org
  - csaf
  - vendor-advisory
  - cisco
epss: 0.00406
epssPercentile: 0.3467
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-17T16:03:41.816941Z'
ingestedAt: '2026-09-16T16:37:52.167Z'
---

## Overview

A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access controls.

This vulnerability is due to a logic error in populating group access control policies (ACPs) with OGS configured. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **cisco-sa-ftd-acl-bypass-8p6vFvw** · Cisco · affected: Cisco Firepower 1000 Series, Cisco 3000 Series Industrial Security Appliances (ISA), Cisco Firepower 9000 Series, Cisco Firepower 4100 Series, Cisco Secure Firewall Threat Defense Virtual, Cisco Secure Firewall 3100 Series, … · updated 2026-09-18 · [advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-acl-bypass-8p6vFvw)