The flaw arises from inadequate validation of HTTP parameters within the SAML 2.0 SSO functionality of Cisco Secure Firewall Adaptive Security Appliance and Threat Defense software. An attacker can craft a malicious URL that reflects unsanitized user input back to the victim’s browser, enabling a reflected cross‑site scripting attack. This could compromise confidential data stored or displayed in the browser context and potentially lead to unauthorized actions performed on behalf of the user.

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software are affected. The vulnerability applies to all versions that include the unpatched SAML component, as no specific version string is provided.

The CVSS score of 6.1 indicates a moderate impact, while the EPSS score of less than 1% suggests a low probability of exploitation in the current environment. The vulnerability is not listed in the KEV catalog, but it can be exploited remotely by an unauthenticated attacker who convinces a user to click a crafted link. Successful exploitation would allow the attacker to inject and execute arbitrary scripts in the victim’s browser session, potentially exfiltrating sensitive data or POSTing malicious requests from the user’s authenticated session.