OTPulse

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Object Group Access Control List Bypass Vulnerabilities

MonitorCVSS 5.8cisco-sa-ftd-acl-bypass-8p6vFvwSep 16, 2026
CiscoEnergyManufacturingTransportation
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Multiple vulnerabilities in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software allow an unauthenticated, remote attacker to bypass configured access controls. The issue is a logic error in the Object Group Search (OGS) implementation that fails to properly evaluate access control policies. An attacker can send traffic that should be blocked by firewall rules using object groups, allowing unauthorized access to protected networks behind the firewall. Affected platforms include Firepower 1000/3000/4100/9000 Series, Secure Firewall 1200/3100/4200 Series, Secure Firewall Threat Defense Virtual, and Adaptive Security Virtual Appliance (ASAv). Cisco has released software updates to address these vulnerabilities.

What this means
What could happen
An attacker can send network traffic that bypasses your firewall's access control rules, potentially reaching protected systems or networks that should be blocked. This happens because of a logic error in how the firewall processes object group-based rules.
Who's at risk
Energy utilities, manufacturing plants, and transportation systems using Cisco Secure Firewall products (including Firepower Series, Secure Firewall Series, and Adaptive Security Virtual Appliances) as perimeter or internal network protection devices. Organizations using object group-based access control rules are specifically at risk.
How it could be exploited
An attacker on the internet sends packets that match a destination or source in an object group ACL rule. Due to the logic error, the firewall fails to properly evaluate the rule and allows the traffic through instead of blocking it. The attacker can reach protected backend systems without authentication.
Prerequisites
  • Network access to the firewall interface
  • Firewall configured with Object Group Search (OGS) in access control policies
  • Traffic destined for a protected network behind the firewall
remotely exploitableno authentication requiredlow complexityaffects network access controls protecting critical infrastructure
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (9)
9 with fix
ProductAffected VersionsFix Status
Firepower 1000 SeriesAll versionsFix available
3000 Series Industrial Security Appliances (ISA)All versionsFix available
Firepower 9000 SeriesAll versionsFix available
Firepower 4100 SeriesAll versionsFix available
Secure Firewall Threat Defense VirtualAll versionsFix available
Secure Firewall 3100 SeriesAll versionsFix available
Secure Firewall 4200 SeriesAll versionsFix available
Secure Firewall 1200 SeriesAll versionsFix available
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/3

Patching may require device reboot — plan for process interruption

Adaptive Security Virtual Appliance (ASAv)
HOTFIXUpdate Adaptive Security Virtual Appliance (ASAv) to the patched software version released by Cisco for September 2026
All products
HOTFIXUpdate Firepower and Secure Firewall devices (1000, 3000, 4100, 4200, 9000 Series and virtual variants) to the patched software versions released by Cisco for September 2026
HARDENINGAudit all access control policies using Object Group Search (OGS) to identify which rules are affected and prioritize testing after patches are applied
View full vendor advisory
API: /api/v1/advisories/a58c2de2-8f9d-4548-9627-ca6e848514b7

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Object Group Access Control List Bypass Vulnerabilities | CVSS 5.8 - OTPulse