A flaw in handling Galois/Counter Mode (GCM)-encrypted IKEv2 traffic on Cisco Secure Firewall ASA and FTD appliances allows an authenticated remote attacker to trigger an unchecked memory allocation error that can force the device to unexpectedly reload, causing a denial of service. The weakness is a size‑validation error during cryptographic processing, classified as CWE‑131. The attack requires valid VPN credentials to initiate the vulnerable traffic, but does not enable code execution or privilege escalation.

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software are affected. No specific firmware or software version numbers are listed in the advisory; organizations should verify whether their deployed versions match the vulnerable releases and whether an update is available.

The vulnerability carries a CVSS score of 7.7, indicating high severity, yet the EPSS score of less than 1% points to a low likelihood of exploitation in the wild. The entry is not cataloged in the CISA Known Exploited Vulnerabilities list. Attackers need authenticated VPN access, limiting the threat mostly to insiders or compromised accounts with VPN credentials. Nonetheless, the potential for a forced device reboot can disrupt network operations, especially in critical environments.