Is CVE-2026-20070 actively exploited?

No active exploitation of CVE-2026-20070 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-20070 be exploited remotely?

Yes. CVE-2026-20070 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-20070?

CVE-2026-20070 has a CVSS score of 6.1 (MEDIUM).

HOME VULNERABILITIESCVE-2026-20070

MEDIUM

CVE-2026-20070

CWE-80Published: March 4, 2026· Updated: Mar 5, 2026

6.1

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:5.2th

Official Description

A vulnerability in the VPN web services component of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a browser that is accessing an affected device. 

This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by persuading a user to follow a link to a malicious website that is designed to submit malicious input to the affected application. A successful exploit could allow the attacker to execute arbitrary HTML or script code in the browser in the context of the VPN web server.

NVD Source

Technical Analysis

CVE-2026-20070 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.