highQCS priority 100/100Cisco

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software for Secure Firewall 3100 and 4200 Series DTLS Denial of Service Vulnerability

A security flaw in Cisco Secure Firewall 3100 and 4200 Series devices allows remote attackers to crash the device by sending special DTLS network messages, causing a denial of service. Cisco has released software updates and workarounds to address this issue.

QCS published 17/9/2026, 10:52:31 am ISTVendor disclosure 18/9/2026, 9:20:31 pm ISTVerified 19/9/2026, 6:59:20 pm ISTRevision 2

An illustration showing crafted DTLS packets targeting a firewall device’s internal hardware causing resource overload and reload, with an operator intervening to remediate.

In plain language

What this advisory means

Technical explanation

How the issue affects the environment

The vulnerability stems from improper resource management in Datagram TLS (DTLS) message handling within Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) Software on 3100 and 4200 Series devices. An unauthenticated attacker can exploit this by sending crafted DTLS traffic streams. This causes the device to reload unexpectedly, leading to a denial of service (DoS). DTLS flow offload—enabled by default—interacts with this flaw. Cisco recommends upgrading to fixed software releases and offers a workaround to disable DTLS flow offload, though this may reduce throughput and increase CPU usage.

Operational impact

Why teams should care

Successful exploitation results in device reloads and service interruptions, causing downtime and potentially impacting network security enforcement and business operations. High-volume DTLS traffic environments disabling flow offload may face performance degradation.

Immediate action

Cisco strongly recommends upgrading affected devices to the fixed software releases specified in the advisory. These contain fixes addressing the DTLS resource management issue that leads to denial of service.

Affected and fixed releases

Affected versionsCisco Secure Firewall ASA Software 9.22 and later with vulnerable hotfixes, Cisco Secure FTD Software 7.6 and 7.7 before fixed releases

Fixed versionsCisco Secure ASA 9.22.3.26, 9.23.1.47, 9.24.1.26 and later, Cisco Secure FTD 7.6.6, 7.7.13, 10.0.2, 10.1.0 and later

Temporary risk reduction

Disable DTLS flow offload using the 'no flow-offload-dtls' CLI command. This forces DTLS traffic to be processed in software rather than hardware, which may reduce throughput and increase CPU utilization, especially in high DTLS traffic scenarios.

Evidence and validation checklist

Cisco PSIRT Advisory cisco-sa-asaftd-dtls-dos-Kp57HkyO
Vulnerability details with CWE-772 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
Explanation of impact causing device reload and DoS
Fixed software release tables included in the advisory
Workaround instructions and considerations

Authoritative reference

Cisco PSIRT Advisories

QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.

Open source