CVE WatchAug 11, 2026

CVE-2018-0296

Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability

CVSS

7.5

High

EPSS

99.9%

p100

KEV

YES

Nov 3, 2021

Exploit Today

0-100

Published: Jun 7, 2018 · Last modified: Aug 11, 2026 · CWE-20 · CWE-22

EPSS · 30d

99.9%EPSS · 30 days99.9%

2026-09-162026-10-14

KEV catalog record

Product

Cisco / Adaptive Security Appliance (ASA)

Vulnerability

Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability

Added to KEV

Nov 3, 2021

Remediate by

May 3, 2022

Known ransomware use

Summary description

Cisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2018-0296

Technical description

A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic. This vulnerability affects Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 1000V Cloud Firewall, ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCvi16029.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-798377.3 HIG

—

———A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior.2h CVE-2026-104025—

—

———Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.2h CVE-2026-798366.4 MED

—

———A vulnerability HPE NonStop SQL/MX Run-Time Statistics may allow an attacker to cause memory corruption and null pointer dereference, potentially leading to process crash, DoS or information disclosure.3h CVE-2026-798352.8 LOW

—

———A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server.3h CVE-2026-798347.4 HIG

—

———A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution.3h CVE-2026-798298.2 HIG

—

———A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.5h