A flaw in the way Cisco Secure Firewall Adaptive Security Appliance (ASA) Software limits embryonic connections can cause the device to drop legitimate incoming TCP SYN packets when under attack. An unauthenticated attacker may craft traffic that triggers this behavior, which in turn prevents establishment of any TCP connection—including remote management access, Remote Access VPN, and other TCP‑based protocols—resulting in a denial of service. (CWE‑772).

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software is impacted. No specific vulnerable versions are listed in the advisory; all versions present in the product line should be considered potentially affected unless otherwise specified by Cisco.

The CVSS score of 8.6 indicates high severity. The EPSS score is below 1 %, reflecting a low predicted exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw can be triggered remotely by sending crafted TCP traffic, the likely attack vector is over the network. Successful exploitation requires only unauthenticated network access and results in a service outage for all TCP‑based services on the device.