CVE-2026-20120: Cisco Firewall ACL Bypass Vulnerability

CVE-2026-20120 Overview

CVE-2026-20120 is an access control bypass vulnerability in the Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. An unauthenticated, remote attacker can send traffic that should be blocked and reach devices in protected networks behind the firewall. The flaw stems from a logic error in how group access control policies (ACPs) are populated when OGS is configured. Cisco published the advisory on 2026-09-16. No public proof-of-concept code or in-the-wild exploitation has been reported.

Critical Impact
Attackers can bypass firewall access control lists and reach internal hosts that administrators believe are protected by Cisco ASA or FTD policy.

Affected Products

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software with ACL Object Group Search enabled
Cisco Secure Firewall Threat Defense (FTD) Software with ACL Object Group Search enabled
Group access control policies (ACPs) using object groups

Discovery Timeline

2026-09-16 - CVE-2026-20120 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-20120

Vulnerability Analysis

The vulnerability is a broken access control weakness ([CWE-284]) in the ACL Object Group Search feature of Cisco ASA and FTD Software. OGS is an optimization that compresses expanded ACL rules using object groups to reduce memory and compilation overhead on the firewall. When group ACPs are populated with OGS enabled, a logic error causes the resulting compiled ruleset to diverge from the administrator's intended policy. Traffic that matches a rule that should deny or drop is instead permitted through the device. The attack is unauthenticated and requires no user interaction, and its scope changes because compromised firewall enforcement affects downstream systems.

Root Cause

The root cause is a logic error in the code path that populates group ACPs when Object Group Search is configured. The compiled access control structures do not correctly reflect the configured deny semantics for certain object group combinations, producing a policy-versus-enforcement mismatch.

Attack Vector

An unauthenticated remote attacker exploits the flaw by sending network traffic through the firewall that matches an ACL rule intended to block it. Because OGS produces an incorrect compiled ACL, the traffic is forwarded to the internal target instead of being dropped. No credentials, prior foothold, or interaction with a legitimate user are required. Consult the Cisco Security Advisory on ACL Bypass for exact affected configurations and fixed release trains.

Detection Methods for CVE-2026-20120

Indicators of Compromise

Successful connections logged on internal hosts from external source addresses that policy should deny
Firewall syslog entries showing built or permitted flow records for source and destination pairs that match deny rules in the configured ACL
Anomalous east-west or inbound sessions to services on protected segments not previously reachable from untrusted zones

Detection Strategies

Compare firewall flow logs against the intended ACL policy and alert on any permitted flow that matches a deny rule with object groups
Baseline expected inbound service exposure per segment and flag new listeners receiving external connections through the firewall
Run periodic policy verification tests by injecting traffic that should be blocked and confirming drops in the ASA or FTD logs

Monitoring Recommendations

Forward ASA and FTD syslog and NetFlow data to a centralized analytics platform for correlation with policy intent
Monitor for changes to object groups and ACL entries that touch OGS-optimized policies
Alert on protected-zone hosts initiating unexpected inbound sessions from untrusted networks

How to Mitigate CVE-2026-20120

Immediate Actions Required

Review the Cisco Security Advisory on ACL Bypass and identify ASA and FTD devices running affected releases with Object Group Search enabled
Apply the fixed software release from Cisco to all affected ASA and FTD appliances
Validate enforcement after patching by testing that traffic matching deny rules is dropped

Patch Information

Cisco has published fixed software versions in the referenced security advisory. Upgrade affected ASA and FTD deployments to a release listed as fixed for CVE-2026-20120. No workaround eliminates the issue without configuration trade-offs, so patching is the recommended remediation path.

Workarounds

Where operationally feasible, disable ACL Object Group Search on affected devices and accept the increased ACL memory and compilation cost until patching is complete
Simplify or refactor object group usage in the affected ACPs to reduce reliance on the vulnerable code path
Add compensating network segmentation controls upstream or downstream of the firewall to limit exposure of protected services

bash

# Configuration example: disable Object Group Search on Cisco ASA as a temporary workaround
# Verify current setting
show running-config object-group-search

# Disable OGS (impacts ACL memory footprint and CPU on large rulesets)
configure terminal
no object-group-search access-control
end
write memory