CVE-2026-20102
EUVD-2026-947204.03.2026, 18:16
A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the SAML feature and access sensitive, browser-based information. This vulnerability is due to insufficient input validation of multiple HTTP parameters. An attacker could exploit this vulnerability by persuading a user to access a malicious link. A successful exploit could allow the attacker to conduct a reflected XSS attack through an affected device.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| cisco | adaptive_security_appliance_software | 9.16.1 ≤ 𝑥 < 9.16.4.89 |
| cisco | adaptive_security_appliance_software | 9.17.1 ≤ 𝑥 < 9.18.4.71 |
| cisco | adaptive_security_appliance_software | 9.20.1 ≤ 𝑥 < 9.20.4.19 |
| cisco | adaptive_security_appliance_software | 9.22.1.1 ≤ 𝑥 < 9.22.2.32 |
| cisco | adaptive_security_appliance_software | 9.23.1 ≤ 𝑥 < 9.23.1.26 |
| cisco | firepower_threat_defense_software | 7.0.0 ≤ 𝑥 < 7.0.9 |
| cisco | firepower_threat_defense_software | 7.1.0 ≤ 𝑥 < 7.2.11 |
| cisco | firepower_threat_defense_software | 7.4.0 ≤ 𝑥 < 7.4.3 |
| cisco | firepower_threat_defense_software | 7.6.0 ≤ 𝑥 < 10.0.0 |
𝑥
= Vulnerable software versions