Security Engineer: 2026-09-21

1. Cisco Secure Firewall ASA and Threat Defense Object Group Access Control List Bypass

   Cisco, 2026-09-18. Read, 7 min.

   Cisco's advisory for CVE-2026-20120 and CVE-2026-20121 describes a logic error in the access control list Object Group Search implementation of Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense software, which could allow an unauthenticated, remote attacker to send traffic that should be blocked through the device and reach systems in protected networks. The advisory was first published on 16 September and updated to version 1.1, final, on 18 September; Cisco rates the vulnerabilities medium at CVSS base 5.8, has released fixed software, states that there are no workarounds, and gives commands for checking whether a device has access control lists with Object Group Search configured.

   Why it matters for this role: Use the commands in the advisory to check whether your ASA or Threat Defense devices have access control lists with Object Group Search configured. There is no workaround, so the fixed release is the remediation, and the traffic at risk is traffic you currently believe is blocked.

Security Engineer