CVE-2026-20222 Overview
CVE-2026-20222 is a denial of service (DoS) vulnerability in the Enhanced Interior Gateway Routing Protocol (EIGRP) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. An unauthenticated, adjacent attacker can trigger a memory leak by sending crafted EIGRP update messages at a high rate, eventually forcing the device to reload. The flaw is classified as a missing release of memory after effective lifetime [CWE-401].
Critical Impact
Successful exploitation causes affected Cisco ASA and FTD devices to exhaust memory and reload unexpectedly, resulting in a full outage of firewall and routing services.
Affected Products
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
- Cisco Secure Firewall Threat Defense (FTD) Software
- Deployments with EIGRP routing enabled on an interface reachable by an adjacent attacker
Discovery Timeline
- 2026-09-16 - CVE-2026-20222 published to the National Vulnerability Database (NVD)
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-20222
Vulnerability Analysis
The vulnerability resides in how Cisco ASA and FTD Software process incoming EIGRP update messages. The EIGRP handler fails to release allocated memory under a sustained flood of crafted updates. Each unhandled update consumes additional memory, and the accumulation continues until the process exhausts available resources.
Once memory is depleted, the affected device reloads. Because EIGRP runs on the data plane control process, the reload interrupts firewall enforcement and all traffic transiting the appliance. Repeated exploitation produces a persistent denial of service.
Root Cause
The root cause is improper resource management in the EIGRP update processing path. Memory allocated to service inbound update packets is not freed on all code paths, matching the classic memory leak pattern described by [CWE-401]. High-rate delivery of crafted updates accelerates the leak beyond what normal EIGRP convergence traffic would produce.
Attack Vector
Exploitation requires network adjacency because EIGRP operates over multicast address 224.0.0.10 and unicast sessions between neighbors on the same Layer 2 segment or logical adjacency. The attacker does not need authentication or user interaction. The attacker sends a sustained stream of malformed or otherwise crafted EIGRP update packets toward an interface on the affected ASA or FTD device where EIGRP is enabled.
No public proof-of-concept exploit is available for CVE-2026-20222 at the time of publication. Refer to the Cisco Security Advisory - EIGRP DoS for authoritative technical details.
Detection Methods for CVE-2026-20222
Indicators of Compromise
- Unexpected reloads of Cisco ASA or FTD devices with crash logs referencing the EIGRP process or memory allocation failures.
- Steady growth in memory utilization on the device without a corresponding increase in traffic or session count.
- High volume of inbound EIGRP packets (IP protocol 88) from a single adjacent source or unexpected neighbor.
Detection Strategies
- Monitor show memory and show processes memory output on ASA/FTD devices for sustained upward trends tied to EIGRP-related processes.
- Alert on abnormal rates of EIGRP update messages arriving on interfaces facing untrusted or semi-trusted segments.
- Correlate device syslog messages for reload events with preceding memory-pressure warnings.
Monitoring Recommendations
- Ingest ASA and FTD syslog and SNMP memory metrics into a centralized analytics platform to baseline normal EIGRP behavior.
- Enable NetFlow or equivalent flow telemetry on adjacent segments to identify unusual EIGRP traffic patterns.
- Review EIGRP neighbor tables with show eigrp neighbors for unauthorized or flapping peers.
How to Mitigate CVE-2026-20222
Immediate Actions Required
- Identify all Cisco ASA and FTD devices with EIGRP enabled and inventory the interfaces participating in EIGRP adjacencies.
- Apply the fixed software releases published in the Cisco Security Advisory - EIGRP DoS as soon as a maintenance window allows.
- Restrict Layer 2 adjacency to trusted routing peers only and remove EIGRP from interfaces where it is not required.
Patch Information
Cisco has published fixed software addressing CVE-2026-20222. Consult the Cisco Security Advisory - EIGRP DoS for the specific fixed release trains for ASA and FTD Software and follow Cisco's upgrade guidance for your platform.
Workarounds
- Disable EIGRP on affected devices if the protocol is not operationally required.
- Configure EIGRP authentication with pre-shared keys so that unauthenticated update messages from adjacent hosts are rejected before deep processing.
- Apply infrastructure access control lists (iACLs) or control-plane policing to rate-limit EIGRP traffic (IP protocol 88) from unexpected sources.
# Configuration example: enable EIGRP MD5 authentication on an ASA/FTD interface
interface GigabitEthernet0/1
authentication mode eigrp 100 md5
authentication key eigrp 100 <shared-secret> key-id 1
!
key chain EIGRP-KEYS
key 1
key-string <shared-secret>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
