{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-20T07:23:33.492","vulnerabilities":[{"cve":{"id":"CVE-2026-20070","sourceIdentifier":"psirt@cisco.com","published":"2026-03-04T18:16:23.170","lastModified":"2026-03-05T19:39:11.967","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in the VPN web services component of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a browser that is accessing an affected device. \r\n\r\nThis vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by persuading a user to follow a link to a malicious website that is designed to submit malicious input to the affected application. A successful exploit could allow the attacker to execute arbitrary HTML or script code in the browser in the context of the VPN web server."},{"lang":"es","value":"Una vulnerabilidad en el componente de servicios web VPN de Cisco Secure Firewall Adaptive Security Appliance (ASA) Software y Cisco Secure Firewall Threat Defense (FTD) Software podría permitir a un atacante remoto no autenticado realizar un ataque de cross-site scripting (XSS) contra un navegador que está accediendo a un dispositivo afectado.\n\nEsta vulnerabilidad se debe a una validación incorrecta de la entrada proporcionada por el usuario en las solicitudes HTTP. Un atacante podría explotar esta vulnerabilidad al persuadir a un usuario para que siga un enlace a un sitio web malicioso que está diseñado para enviar entrada maliciosa a la aplicación afectada. Un exploit exitoso podría permitir al atacante ejecutar código HTML o de script arbitrario en el navegador en el contexto del servidor web VPN."}],"metrics":{"cvssMetricV31":[{"source":"psirt@cisco.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}]},"weaknesses":[{"source":"psirt@cisco.com","type":"Primary","description":[{"lang":"en","value":"CWE-80"}]}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-xss-uwjc4HR","source":"psirt@cisco.com"}]}}]}