On 2024-02-15, CISA added CVE-2020-3259 (Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)) to its Known Exploited Vulnerabilities (KEV) catalog [2]. The vulnerability is listed in the catalog as "Cisco ASA and FTD Information Disclosure Vulnerability" [2]. CISA requires applying mitigations in accordance with vendor instructions; see the full text below for specific requirements [2].
Backfill: this event became public on Feb 15, 2024 and we added it on Nov 10, 2026. It is not a new event.
CISA Adds Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Vulnerability CVE-2020-3259 to Known Exploited Vulnerabilities Catalog
1 min read
- Disclosed
- Feb 15, 2024
- Published
- Nov 10, 2026
- Last updated
- Nov 8, 2026
- CVSS basis
- Our assessment
- 71.5%, higher than 99% of CVEs
- Exploitation and patch status
- ExploitedKEV
- Attack vector
- Vulnerability status
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Government, Cross-industry
What to do nowOur advice
CISA requires applying mitigations in accordance with vendor instructions; see the full text for specific requirements [2].
Timeline
Technical details
CISA KEV Listing
On 2024-02-15, CISA added CVE-2020-3259 to the Known Exploited Vulnerabilities () catalog for Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) [2].
Original Technical Description
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations. [2]
Official Requirements
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. [2]
Individual Vulnerability Record
The U.S. National Vulnerability Database (NVD) provides an independent vulnerability record and description for CVE-2020-3259 [1].
References
Official / primary3
- [1]
“A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential in”
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.