Platform
cisco
Component
secure-web-appliance
Fixed in
11.8.1
12.5.4
12.0.4
12.0.4
14.1.1
14.1.1
14.1.1
12.0.5
14.0.3
11.8.1
12.0.2
11.8.2
11.8.4
11.8.4
12.5.2
11.8.5
12.5.3
12.5.3
14.5.1
12.5.5
12.5.5
12.0.6
14.0.4
12.5.6
12.5.6
12.5.6
14.0.5
14.5.2
14.5.2
15.0.1
15.0.1
12.5.7
15.1.1
14.5.3
15.2.1
14.0.6
15.2.1
14.5.2
12.0.3
12.0.3
14.5.2
14.5.4
15.0.2
15.2.2
14.5.1
14.5.1
12.0.2
14.0.2
14.0.2
11.8.1
14.0.2
14.0.2
12.5.2
15.2.3
15.2.4
15.2.5
15.2.6
15.2.6
14.6.1
CVE-2026-20152 describes an authentication bypass vulnerability in the Cisco Secure Web Appliance. This flaw allows an unauthenticated, remote attacker to circumvent authentication policy requirements, potentially granting unauthorized access. The vulnerability impacts versions 11.8.0 through 15.2.5-013 of the Cisco Secure Web Appliance, and a fix is currently available from Cisco.
Successful exploitation of CVE-2026-20152 allows an attacker to bypass authentication policies on the affected Cisco Secure Web Appliance. This means an attacker who can send crafted HTTP requests can avoid the intended security controls, potentially gaining access to resources or functionality they should not have. The impact extends beyond simple access; an attacker could potentially modify configurations or exfiltrate sensitive data depending on the appliance's role and the policies in place. While the description doesn't explicitly mention lateral movement, bypassing authentication could be a stepping stone to further compromise the network if the appliance is integrated with other systems.
CVE-2026-20152 was publicly disclosed on 2026-04-15. The CVSS score is MEDIUM (5.3), indicating a moderate risk. There is no indication of active exploitation campaigns or KEV listing at the time of writing. Public proof-of-concept exploits are currently unavailable, but the relatively straightforward nature of the vulnerability (HTTP request manipulation) suggests that one may emerge.
Exploit Status
EPSS
0.08% (25% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-20152 is to upgrade to a patched version of Cisco Secure Web Appliance. Cisco has released a fix, though the specific version is not provided in the CVE details. Before upgrading, review Cisco's release notes to ensure compatibility with your existing infrastructure and to understand any potential breaking changes. If an immediate upgrade is not feasible, consider implementing stricter HTTP request validation rules at a proxy or WAF level to filter out potentially malicious requests. Monitor authentication logs for suspicious activity and unusual patterns.
Update your Cisco Secure Web Appliance to a corrected version. See the Cisco advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-auth-bypass-6YZkTQhd) for details on corrected versions and upgrade instructions.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-20152 is a medium-severity vulnerability in Cisco Secure Web Appliance allowing unauthenticated attackers to bypass authentication policies via crafted HTTP requests, potentially granting unauthorized access.
You are affected if you are using Cisco Secure Web Appliance versions 11.8.0 through 15.2.5-013. Check your version and upgrade as soon as possible.
Upgrade to a patched version of Cisco Secure Web Appliance. Consult Cisco's advisory for the specific fixed version and release notes.
There is currently no indication of active exploitation, but the vulnerability's nature suggests potential for exploitation.
Refer to the official Cisco Security Advisory for CVE-2026-20152 on Cisco's website (search for CVE-2026-20152 on Cisco.com).
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.