A vulnerability in the Secure Sockets Layer (SSL) packet reassembly functionality of the detection engine in Cisco Firepower System Software

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• cisco secure firewall management center5.4.0
• cisco secure firewall management center6.0.0
• cisco secure firewall management center6.1.0
• cisco secure firewall management center6.2.0
• cisco secure firewall management center6.2.1

Versions reported by the vendor

Affected version ranges reported by the assigning authority (cisco). Independent of NVD's CPE analysis and usually ahead of it.

• n/a Cisco Firepower Detection Engine

  • Cisco Firepower Detection Engineaffected

Other highest-scoring records for the same primary product.

• CVE-2026-20079Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution VulnerabilityKEV
  96Now
• CVE-2026-20131Cisco Secure Firewall Management Center Software Remote Code Execution VulnerabilityKEV
  83Now
• CVE-2026-20316Cisco Secure Firewall Management Center Software Static Credential VulnerabilityKEV
  62This week
• CVE-2016-6433The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrar
  59Plan
• CVE-2025-20265Cisco Secure Firewall Management Center Software Radius Remote Code Execution Vulnerability
  45Plan
• CVE-2023-20048A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attac
  44Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.