Security Architect: 2026-09-21

1. Cisco Secure Firewall ASA and Threat Defense Object Group Access Control List Bypass

   Cisco, 2026-09-18. Read, 7 min.

   Cisco's advisory for CVE-2026-20120 and CVE-2026-20121 describes a logic error in the access control list Object Group Search implementation of Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense software, which could allow an unauthenticated, remote attacker to send traffic that should be blocked through the device and reach systems in protected networks. The advisory was first published on 16 September and updated to version 1.1, final, on 18 September; Cisco rates the vulnerabilities medium at CVSS base 5.8, has released fixed software, states that there are no workarounds, and gives commands for checking whether a device has access control lists with Object Group Search configured.

   Why it matters for this role: A control can fail in its implementation rather than its design. If your segmentation rests on these access control lists, the remediation is a software upgrade and the interim exposure is reachability into the networks those lists protect.

Security Architect