CVE-2026-20056: Cisco Secure Web Appliance

Medium severity, CVSS 4.0. EPSS: 0.2% chance of exploitation in the next 30 days.

A vulnerability in the Dynamic Vectoring and Streaming (DVS) Engine implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass the anti-malware scanner, allowing malicious archive files to be downloaded. This vulnerability is due to improper handling of certain archive files. An attacker could exploit this vulnerability by sending a crafted archive file, which should be blocked, through an affected device. A successful exploit could allow the attacker to bypass the anti-malware scanner and download malware onto an end user workstation. The downloaded malware will not automatically execute unless the end user extracts and launches the malicious file. 

Affected products

• Cisco Cisco Secure Web Appliance: version 11.8.0-453 only; version 12.5.3-002 only; version 12.0.3-007 only; version 12.0.3-005 only; version 14.1.0-032 only; version 14.1.0-047 only; …

Published 2026-02-04. Last modified 2026-06-17.