Summary

• A vulnerability in the CLI of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software in multiple context mode could allow an authenticated, local attacker with administrative privileges in one context to copy files to or from another context, including configuration files.

   

  This vulnerability is due to improper access controls for Secure Copy Protocol (SCP) operations when the Cisco SSH stack is enabled. An attacker could exploit this vulnerability by authenticating to a non-admin context of the device and issuing crafted SCP copy commands in that non-admin context. A successful exploit could allow the attacker to read, create, or overwrite sensitive files that belong to another context, including the admin and system contexts. The attacker cannot directly impact the availability of services that pertain to other contexts. To exploit this vulnerability, the attacker must have valid administrative credentials for a non-admin context.

   

  Note: An attacker cannot list or enumerate files from another context and would need to know the exact file path, which increases the complexity of a successful attack.

  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-scpcxt-filecpy-rgeP73nE

  This advisory is part of the March 2026 release of the Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: March 2026 Semiannual Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software Security Advisory Bundled Publication.

Affected Products

• Vulnerable Products

  This vulnerability affects Cisco products if they are running a vulnerable release of Cisco Secure Firewall ASA Software and meet both of the following conditions:

  • Multiple context mode is configured.
  • The Cisco SSH stack is enabled.

  For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.

  Determine Whether Multiple Context Mode Is Enabled

  To determine whether multiple context mode is enabled, use the show mode command. If the output of that command states multiple as shown in the following example, multiple context mode is enabled:

  ciscoasa# show mode
  Security context mode: multiple
  ciscoasa#

  If the output states single, multiple context mode is not enabled, and the device is not considered vulnerable.

  Determine Whether the Cisco SSH Stack Is Enabled

  To determine whether the Cisco SSH stack is enabled on a device, use the show ssh | include stack command and verify if the ciscoSSH stack is ENABLED, as shown in the following example:

  ciscoasa# show ssh | include stack
  ciscoSSH stack  : ENABLED
  ciscoasa#

  If the output is empty or reports ciscoSSH stack as DISABLED, the Cisco SSH stack is not enabled, and the device is not considered vulnerable.

  Notes:

  • The Cisco SSH stack was first introduced in Cisco Secure Firewall ASA Software Release 9.17.1. 
  • In Cisco Secure Firewall ASA Software releases 9.23.1 and later, Cisco SSH is the only supported SSH stack.

   

  Products Confirmed Not Vulnerable

  Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.

  Cisco has confirmed that this vulnerability does not affect the following Cisco products:

  • Secure Firewall Threat Defense (FTD) Software
  • Secure Firewall Management Center (FMC) Software

Workarounds

• There are no workarounds that address this vulnerability.

Fixed Software

• Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.

  Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software

  To help customers determine their exposure to vulnerabilities in Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software, Cisco provides the Cisco Software Checker. This tool identifies any Cisco security advisories that impact a specific software release and the earliest release that fixes the vulnerabilities that are described in each advisory (“First Fixed”). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities that are described in all the advisories that the Software Checker identifies (“Combined First Fixed”).

  To use the tool, go to the Cisco Software Checker page and follow the instructions. Alternatively, use the following form to search for vulnerabilities that affect a specific software release. To use the form, follow these steps:

  1. Choose which advisories the tool will search—all advisories, only advisories with a Critical or High Security Impact Rating (SIR), or only this advisory.
  2. Choose the appropriate software.
  3. Choose the appropriate platform.
  4. Enter a release number—for example, 9.20.3.4 for Cisco Secure Firewall ASA Software or 7.4.2 for Cisco Secure FTD Software.
  5. Click Check.

  Only this advisoryAll Critical and High advisoriesAll advisoriesCisco ASA SoftwareCisco FMC SoftwareCisco FTD SoftwareAny Platform3000 Series Industrial Security Appliances (ISA)ASA 5500-X Series FirewallsASA Service ModuleAdaptive Security Virtual Appliance (ASAv)Firepower 1000 SeriesFirepower 2100 SeriesFirepower 4100 SeriesFirepower 9000 SeriesSecure Firewall 1200 SeriesSecure Firewall 3100 SeriesSecure Firewall 4200 Series

   

   

  Additional Resources

  For help determining the best Cisco Secure Firewall ASA, Secure FMC, or Secure FTD Software release, see the following Recommended Releases documents. If a security advisory recommends a later release, Cisco recommends following the advisory guidance.

  Cisco Secure Firewall ASA Compatibility
  Cisco Secure Firewall ASA Upgrade Guide
  Cisco Secure Firewall Threat Defense Compatibility Guide

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Source

• This vulnerability was found during the resolution of a Cisco Technical Assistance Center (TAC) support case.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-scpcxt-filecpy-rgeP73nE

Revision History

• Version	Description	Section	Status	Date
  1.0	Initial public release.	—	Final	2026-MAR-04

  Show Less