CVE-2026-20121

Sentinel/Defender KQL

// This query is a placeholder. Actual detection requires understanding expected traffic patterns and identifying anomalies where traffic that should be blocked by OGS-configured ACLs is allowed.
// Example: Monitor firewall logs for traffic from known malicious sources or to sensitive internal resources that should be denied by ACLs.
// Replace 'YourFirewallLogs' with the actual log table for your Cisco Secure Firewall ASA/FTD.
YourFirewallLogs
| where Action == "Permit"
| where DestinationIP in ("<Sensitive_Internal_IPs>") // IPs that should be protected by OGS ACLs
| where SourceIP in ("<External_Untrusted_IPs>") // IPs that should be blocked by OGS ACLs
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, Action, RuleName
| extend Anomaly = iff(RuleName has "OGS_ACL" and Action == "Permit", "Potential ACL Bypass", "")
| where isnotempty(Anomaly)

Splunk SPL

# This query is a placeholder. Actual detection requires understanding expected traffic patterns and identifying anomalies where traffic that should be blocked by OGS-configured ACLs is allowed.
# Example: Monitor firewall logs for traffic from known malicious sources or to sensitive internal resources that should be denied by ACLs.
# Replace 'sourcetype=cisco:asa' or 'sourcetype=cisco:ftd' with the actual sourcetype for your Cisco Secure Firewall ASA/FTD logs.
sourcetype=cisco:asa OR sourcetype=cisco:ftd action=permit dest_ip IN ("<Sensitive_Internal_IPs>") src_ip IN ("<External_Untrusted_IPs>")
| eval Anomaly = if(match(_raw, "OGS_ACL") AND action="permit", "Potential ACL Bypass", "")
| where isnotnull(Anomaly)
| table _time, src_ip, dest_ip, dest_port, action, rule_name

Sigma

title: Cisco Secure Firewall OGS ACL Bypass Anomaly
id: 00000000-0000-0000-0000-000000000000 # Placeholder: Generate a unique GUID
status: experimental
description: Detects potential ACL bypass due to OGS logic error on Cisco Secure Firewall ASA/FTD by identifying traffic that should be blocked but is permitted.
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-acl-bypass-8p6vFvw
logsource:
  product: firewall
  vendor: cisco
detection:
  selection:
    action: 'permit'
    # Replace with actual fields and values for sensitive internal IPs and untrusted external IPs
    # Example: dest_ip: ['192.168.1.0/24', '10.0.0.0/8']
    # Example: src_ip: ['<External_Untrusted_IPs>']
    # This requires customization based on your network's protected assets and expected blocked sources.
    # rule_name|contains: 'OGS_ACL' # If rule names explicitly indicate OGS usage
  condition: selection
level: high

Elastic ES|QL

// This query is a placeholder. Actual detection requires understanding expected traffic patterns and identifying anomalies where traffic that should be blocked by OGS-configured ACLs is allowed.
// Example: Monitor firewall logs for traffic from known malicious sources or to sensitive internal resources that should be denied by ACLs.
// Replace 'logs-firewall.cisco.*' with the actual index pattern for your Cisco Secure Firewall ASA/FTD logs.
FROM logs-firewall.cisco.*
WHERE event.action == "permit"
AND destination.ip IN ("<Sensitive_Internal_IPs>") // IPs that should be protected by OGS ACLs
AND source.ip IN ("<External_Untrusted_IPs>") // IPs that should be blocked by OGS ACLs
// AND rule.name : "OGS_ACL*" // If rule names explicitly indicate OGS usage
| SELECT @timestamp, source.ip, destination.ip, destination.port, event.action, rule.name
| EVAL anomaly = IF(rule.name LIKE "OGS_ACL%" AND event.action == "permit", "Potential ACL Bypass", NULL)
| WHERE anomaly IS NOT NULL