The vulnerability stems from insufficient error handling when Cisco ASA and FTD SAML 2.0 SSO processes incoming SAML messages. An attacker who can send crafted SAML assertions to the firewall’s SAML service can trigger an unexpected device reload, effectively taking the firewall offline and disrupting network connectivity.

This flaw affects Cisco Secure Firewall Adaptive Security Appliance and Cisco Secure Firewall Threat Defense software. The advisory does not list specific firmware or software releases that are vulnerable, so any deployment of these products with SAML 2.0 SSO enabled remains at risk until patched.

The CVSS score of 8.6 indicates a high severity vulnerability, yet the EPSS score is less than 1 percent and the flaw is not yet listed in CISA’s KEV catalog, suggesting a low probability of exploitation at present. Nevertheless, the vulnerability can be leveraged remotely by an unauthenticated attacker who can reach the SAML endpoint, which is likely exposed on the firewall’s management interface. A successful attack results in a forced reload, creating a denial-of-service condition.