CVE-2026-20121: Cisco Firewall ACL Bypass Vulnerability

CVE-2026-20121 Overview

CVE-2026-20121 is an access control bypass vulnerability in the Access Control List (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. An unauthenticated, remote attacker can send traffic that should be blocked through an affected device and reach systems in protected network segments. The root cause is a logic error in how group access control policies (ACPs) are populated when OGS is configured. The issue is tracked under CWE-284: Improper Access Control.

Critical Impact
Attackers can bypass configured firewall access controls and reach hosts in protected networks without authentication or user interaction.

Affected Products

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software with ACL Object Group Search enabled
Cisco Secure Firewall Threat Defense (FTD) Software with ACL Object Group Search enabled
Deployments using group access control policies (ACPs) with OGS configured

Discovery Timeline

2026-09-16 - CVE-2026-20121 published to NVD
2026-09-16 - Last updated in NVD database
Vendor advisory: Cisco Security Advisory cisco-sa-ftd-acl-bypass-8p6vFvw

Technical Details for CVE-2026-20121

Vulnerability Analysis

The vulnerability exists in the Object Group Search (OGS) optimization used by Cisco ASA and FTD to evaluate access control lists. OGS reduces the memory footprint of large ACLs by storing object groups by reference rather than expanding them into individual rules. When group access control policies are populated with OGS enabled, a logic error produces an inconsistent policy state on the device. Traffic that the configured policy should deny is instead permitted to traverse the firewall. Because the flaw resides in policy evaluation, exploitation requires no credentials, no user interaction, and only network reachability to the affected data plane.

Root Cause

The defect is a logic error in the code path that populates group ACPs when OGS is configured. The compiled policy fails to represent one or more deny conditions that the administrator defined, so packets matching those conditions are evaluated against an incomplete ruleset and allowed. This is a classification of CWE-284: Improper Access Control.

Attack Vector

An unauthenticated remote attacker exploits the flaw by sending network traffic through the affected firewall toward a destination that policy should block. Because the missing rule condition applies at policy-evaluation time, the attacker does not need to interact with the management plane or authenticate. Successful exploitation grants network reachability to hosts that administrators intended to isolate, enabling downstream reconnaissance or exploitation of internal services. The vulnerability does not directly grant code execution on the firewall itself; its impact is limited to integrity of the enforced access controls.

No verified public proof-of-concept code is available. Refer to the Cisco Security Advisory for authoritative technical details.

Detection Methods for CVE-2026-20121

Indicators of Compromise

Successful network connections to internal hosts or services that ACL policy should have denied
Firewall connection or flow logs showing Built connections for source, destination, or port combinations covered by deny rules within OGS-based ACPs
Unexpected east-west or inbound traffic reaching protected network segments from untrusted zones

Detection Strategies

Correlate firewall connection logs against the intended policy matrix and alert when permitted flows contradict a documented deny rule
Compare compiled ACL output on the device (for example, show access-list) with the configured object-group definitions to identify missing rule expansions
Deploy internal network sensors behind the firewall to identify traffic that should not be present in protected segments

Monitoring Recommendations

Increase log verbosity on ASA and FTD ACL rules that reference object groups and forward events to a centralized analytics platform
Alert on new source addresses connecting to management, database, or other restricted internal services from untrusted zones
Baseline expected inter-zone traffic and generate alerts on deviations while investigation is underway

How to Mitigate CVE-2026-20121

Immediate Actions Required

Review the Cisco Security Advisory cisco-sa-ftd-acl-bypass-8p6vFvw to identify fixed software versions applicable to your ASA and FTD deployments
Inventory devices where Object Group Search is enabled on group access control policies
Schedule and apply the vendor-provided software update to all affected ASA and FTD appliances
Validate policy enforcement after upgrade by testing traffic that should be denied against representative flows

Patch Information

Cisco has published fixed software releases in the vendor advisory. Consult the Cisco Security Advisory for the specific fixed versions that correspond to your ASA or FTD train. Apply patches through standard Cisco upgrade procedures and verify running-configuration consistency after reload.

Workarounds

If immediate patching is not possible, evaluate disabling the Object Group Search optimization on affected policies as directed by the vendor advisory, accepting the associated memory impact on large ACLs
Add compensating segmentation controls, such as upstream or downstream ACLs on adjacent routers or switches, to enforce deny conditions independently of the affected firewall
Restrict exposure of protected services with host-based firewalls and require authentication at the application layer where feasible

bash

# Verify whether Object Group Search is enabled on an ASA device
show running-config | include object-group-search

# Review compiled ACL entries to confirm expected deny rules are present
show access-list <acl-name>