highQCS priority 100/100Cisco

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Logging Denial of Service Vulnerability

A weakness in Cisco Secure Firewall devices can let an attacker remotely overload the system's processor by sending many fake connection requests. This causes the firewall to slow down or stop working properly, leading to a denial of service. Cisco has released software updates to fix this issue, and there are temporary ways to reduce the risk until updates are applied.

Published 18/9/2026, 3:50:56 pmVerified 18/9/2026, 6:24:56 pmRevision 1

Cisco high network security advisory visual

In plain language

What this advisory means

Technical explanation

How the issue affects the environment

The vulnerability exists in the rate-limiting mechanism for syslog message 419002 within Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Improper rate limiting allows an unauthenticated attacker to flood the device with TCP SYN packets, triggering excessive syslog logging events. This leads to high CPU utilization on the affected device, degrading performance and potentially causing a denial of service (DoS). Logging message 419002 is enabled by default when global logging is enabled. Cisco released fixed software versions that address the improper rate limiting, and workarounds include manually setting rate limits on this specific logging message to mitigate CPU overload.

Operational impact

Why teams should care

If exploited, this vulnerability can cause critical Cisco firewall devices to experience high CPU usage, resulting in degraded network performance or outages. This can interrupt business operations and potentially expose organizational networks to additional threats due to reduced firewall availability. Organizations using affected Cisco Secure Firewall ASA and FTD devices should prioritize remediation to maintain network security and availability.

Immediate action

Cisco strongly recommends upgrading affected devices to the fixed software releases listed in the advisory to fully resolve this vulnerability. Detailed fixed release versions are provided for both ASA and FTD software. Testing remediation in a controlled environment before deployment is advised.

Affected and fixed releases

Affected versionsCisco Secure Firewall ASA Software releases 9.16 and earlier, 9.18, 9.20, 9.22, 9.23, 9.24 (specific versions detailed in advisory), Cisco Secure FTD Software releases 7.0 and earlier, 7.2, 7.4, 7.6, 7.7, 10.0, 10.1 (specific versions detailed in advisory)

Fixed versionsASA Software 9.16.4.103, 9.18.4.94, 9.20.4.49, 9.22.3.26, 9.23.1.47, 9.24.1.26 and later, FTD Software 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, 10.1.0 and later

Temporary risk reduction

A workaround is to manually apply rate limiting to syslog message 419002, restricting it to 100 messages per second. For ASA devices, this is done via the CLI with 'logging rate-limit 100 1 message 419002'. For FTD devices, rate limiting can be configured either through the Secure Firewall Management Center or Firepower Device Manager interfaces. This mitigation reduces the risk but may impact logging functionality and should be evaluated in each environment.

Evidence and validation checklist

Cisco official security advisory from Cisco PSIRT Advisories
Detailed vulnerability description and diagnostic commands from Cisco advisory
Fixed software release tables and recommended upgrade paths
Workaround configuration commands and management interface instructions
Statements regarding absence of public exploitation as of advisory publication date

Authoritative reference

Cisco PSIRT Advisories

QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.

Open source