A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS Software, Cisco IOS XE Software, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition on an affected device. This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device. A successful exploit of Cisco IOS Software and IOS XE Software could allow the attacker to cause the affected device to reload, resulting in a DoS condition. A successful exploit of Cisco Secure Firewall ASA Software and Secure FTD Software could allow the attacker to partially exhaust system memory, resulting in system instability, such as the inability to establish new IKEv2 VPN sessions. A manual reboot of the device is required to recover from this condition.

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability.

  - A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS XE Software could allow an     unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition on an     affected device. This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this     vulnerability by sending crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker     to partially exhaust system memory, resulting in system instability, such as the inability to establish new IKEv2 VPN     sessions. A manual reboot of the device is required to recover from this condition. (CVE-2026-20012)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

According to its self-reported version, Cisco IOS Software is affected by a vulnerability.

  - A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS Software could allow an     unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition on an     affected device. This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this     vulnerability by sending crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker     to partially exhaust system memory, resulting in system instability, such as the inability to establish new IKEv2 VPN     sessions. A manual reboot of the device is required to recover from this condition. (CVE-2026-20012)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

According to its self-reported version, Cisco Firepower Threat Defense Software is affected by a vulnerability.

  - A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco Secure Firewall Threat     Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting     in a denial of service (DoS) condition on an affected device. This vulnerability is due to improper parsing     of IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an     affected device. A successful exploit could allow the attacker to partially exhaust system memory, resulting     in system instability, such as the inability to establish new IKEv2 VPN sessions. A manual reboot of the     device is required to recover from this condition. (CVE-2026-20012)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

According to its self-reported version, Cisco Adaptive Security Appliance (ASA) Software is affected by a vulnerability.

  - A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco Secure Firewall Adaptive     Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to trigger a memory leak,     resulting in a denial of service (DoS) condition on an affected device. This vulnerability is due to     improper parsing of IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2     packets to an affected device. A successful exploit could allow the attacker to partially exhaust system     memory, resulting in system instability, such as the inability to establish new IKEv2 VPN sessions. A     manual reboot of the device is required to recover from this condition. (CVE-2026-20012)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

ID	Name	Product	Family	Severity
304813	Cisco IOS XE Software IKEv2 DoS (cisco-sa-asa-ftd-ios-dos-kPEpQGGK)	Nessus	CISCO	high
304812	Cisco IOS Software IKEv2 DoS (cisco-sa-asa-ftd-ios-dos-kPEpQGGK)	Nessus	CISCO	high
304805	Cisco Secure Firewall Threat Defense Software IKEv2 DoS (cisco-sa-asa-ftd-ios-dos-kPEpQGGK)	Nessus	CISCO	high
304804	Cisco Secure Firewall Adaptive Security Appliance Software IKEv2 DoS (cisco-sa-asa-ftd-ios-dos-kPEpQGGK)	Nessus	CISCO	high

Detections

Analytics

CVE-2026-20012

high

Tenable Plugins

high

high

high

high