An authenticated user connection to the Remote Access SSL VPN can send specially crafted packets that are accepted without adequate validation, leading the VPN server to consume increasing amounts of memory. The unchecked input causes a memory leak (CWE‑401) and eventually forces the device to reload, resulting in a denial of service for all users. No impact is seen on the management or MUS interfaces.

Cisco Secure Firewall Adaptive Security Appliance and Cisco Secure Firewall Threat Defense are affected. The vulnerability applies to any deployed version of these products that has Remote Access SSL VPN enabled; no specific downstream version numbers are listed in the advisory, so all current builds should be reviewed.

The CVSS base score of 7.7 indicates a high‑to‑medium risk, while the EPSS score of less than 1% suggests a low but non‑zero probability of exploitation. The attack requires an authenticated VPN session, so an attacker must possess valid credentials to connect first. Once authenticated, the attacker can transmit malicious packets that trigger memory exhaustion, causing the device to reload and denying service to all users. The vulnerability is not in the CISA KEV catalogue, which reflects that no widespread exploitation has been observed yet.