CVE-2026-20012: Cisco IKEv2 DoS Vulnerability

CVE-2026-20012 Overview

A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS Software, Cisco IOS XE Software, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition on an affected device.

This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device. A successful exploit of Cisco IOS Software and IOS XE Software could allow the attacker to cause the affected device to reload, resulting in a DoS condition. A successful exploit of Cisco Secure Firewall ASA Software and Secure FTD Software could allow the attacker to partially exhaust system memory, resulting in system instability, such as the inability to establish new IKEv2 VPN sessions. A manual reboot of the device is required to recover from this condition.

Critical Impact

Unauthenticated remote attackers can cause device reloads on IOS/IOS XE systems or exhaust memory on ASA/FTD devices, disrupting VPN connectivity and requiring manual intervention to restore services.

Affected Products

• Cisco IOS Software with IKEv2 enabled
• Cisco IOS XE Software with IKEv2 enabled
• Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
• Cisco Secure Firewall Threat Defense (FTD) Software

Discovery Timeline

• 2026-03-25 - CVE-2026-20012 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-20012

Vulnerability Analysis

This vulnerability falls under CWE-401 (Missing Release of Memory after Effective Lifetime), commonly known as a memory leak vulnerability. The flaw exists in how affected Cisco products handle IKEv2 packet parsing. When specially crafted IKEv2 packets are processed, the system fails to properly release allocated memory, leading to a gradual exhaustion of available system resources.

The impact varies by platform: Cisco IOS and IOS XE devices will crash and reload when memory is exhausted, while ASA and FTD platforms experience partial memory exhaustion leading to system instability and the inability to establish new VPN sessions. The network-based attack vector with no authentication requirements makes this vulnerability particularly concerning for internet-facing VPN concentrators.

Root Cause

The root cause is improper memory management in the IKEv2 packet parsing logic. When the affected devices process malformed or specially crafted IKEv2 packets, memory allocated during parsing is not properly freed after the operation completes. This results in memory being consumed with each malicious packet without being reclaimed, eventually leading to resource exhaustion.

Attack Vector

The attack can be executed remotely over the network without requiring authentication. An attacker sends crafted IKEv2 packets to UDP port 500 or 4500 on an affected device. The attack does not require any user interaction and can be performed by any unauthenticated remote attacker with network access to the IKEv2 service.

The vulnerability affects the IKEv2 protocol implementation, which is commonly used for IPsec VPN connectivity. Devices configured to terminate IKEv2 VPN connections are at risk. Since IKEv2 is often exposed to the internet for remote access VPN functionality, the attack surface can be significant in enterprise environments.

Detection Methods for CVE-2026-20012

Indicators of Compromise

• Unusual increase in memory utilization on affected Cisco devices without corresponding legitimate traffic growth
• Failed VPN session establishments with memory-related error messages in system logs
• Unexpected device reloads on IOS/IOS XE platforms with crash dumps indicating memory exhaustion
• High volume of IKEv2 packets from suspicious source addresses targeting UDP ports 500 or 4500

Detection Strategies

• Monitor device memory utilization trends and alert on anomalous increases
• Implement IDS/IPS signatures to detect malformed IKEv2 packets
• Review syslog messages for IKEv2 parsing errors or memory allocation failures
• Deploy network traffic analysis to identify unusual IKEv2 traffic patterns or volumes

Monitoring Recommendations

• Enable SNMP memory monitoring with thresholds to alert before critical exhaustion
• Configure syslog forwarding to a SIEM for centralized analysis of device events
• Implement NetFlow or similar flow analysis to track IKEv2 traffic volumes
• Establish baseline memory patterns to identify deviations that may indicate active exploitation

How to Mitigate CVE-2026-20012

Immediate Actions Required

• Review the Cisco Security Advisory for specific affected versions and patch information
• Identify all devices running affected Cisco IOS, IOS XE, ASA, or FTD software with IKEv2 enabled
• Prioritize patching internet-facing VPN concentrators and devices with IKEv2 services exposed
• Implement network access controls to limit IKEv2 access to trusted IP ranges where feasible

Patch Information

Cisco has released software updates that address this vulnerability. Administrators should consult the Cisco Security Advisory for the specific fixed software versions applicable to their deployed products. The advisory contains detailed information about which software releases contain the fix and upgrade paths for affected systems.

Workarounds

• Restrict IKEv2 access using access control lists (ACLs) to limit exposure to trusted IP addresses only
• Consider implementing rate limiting for IKEv2 traffic to slow potential exploitation attempts
• Monitor affected devices more frequently for signs of memory exhaustion during the patch deployment window
• Where operationally feasible, temporarily disable IKEv2 on devices not actively requiring it until patches can be applied

# Example ACL configuration to restrict IKEv2 access (IOS/IOS XE)
# Adjust IP ranges to match your trusted sources
access-list 100 permit udp host 192.168.1.0 0.0.0.255 any eq 500
access-list 100 permit udp host 192.168.1.0 0.0.0.255 any eq 4500
access-list 100 deny udp any any eq 500
access-list 100 deny udp any any eq 4500