Cisco Systems has disclosed multiple vulnerabilities in its Cisco Secure Firewall product family and released a coordinated set of security updates. The company published its advisory on 16 September 2026, addressing issues in Adaptive Security Appliance (ASA), Threat Defense (FTD), and Management Center (FMC) software.
The release resolves 29 CVEs across 14 distinct advisories. Five of these advisories are rated Critical, accounting for 18 CVEs. The flaws enable remote code execution without authentication, administrator privilege escalation, denial-of-service conditions, information disclosure, and authentication bypass.
Among the most severe issues are sftunnel root arbitrary code execution and Java deserialization remote code execution vulnerabilities in Management Center. Additional problems affect IKEv2 certificate authentication, DTLS, TLS 1.3, EIGRP, TCP DNS, and Snort 2 SSL/TLS handling, leading to denial-of-service risks. One advisory also covers object group access control list bypass vulnerabilities.
Cisco noted that it sometimes assigns a single CVE to multiple related weaknesses belonging to the same CWE class; eight such CVEs appear in this hardening release. CVSS v3.1 base scores range from 7.5 to a high of 9.9 for two issues.
Administrators are urged to apply the available software updates immediately, especially for internet-facing appliances where exploitation has already been observed.
