CSCwo94394 - Remove unsafe directives Content-Security-Policy header

wagner.cecato — Sat, 11 Apr 2026 10:51:36 GMT

Hi all,
I’m trying to find out if bug CSCwo94394 (“Remove unsafe-inline and unsafe-eval directives from Content-Security-Policy header on VPN web server”) has been resolved in any released ASA version yet.
We are currently running ASA 9.22(2) and our security vendor (SecurityScorecard) is flagging the broad CSP directives on the AnyConnect login page. The bug describes exactly our scenario.
Does anyone know:
1. Has this fix been released in any ASA interim or maintenance build?
2. If not, is there an estimated target release?
Any help appreciated. Thanks.

Re: CSCwo94394 - Remove unsafe directives Content-Security-Policy head

Mark Elsen — Sat, 11 Apr 2026 11:27:28 GMT

@wagner.cecato >....2. If not, is there an estimated target release?
The full bug report : https://bst.cisco.com/bugsearch/bug/CSCwo94394?rfs=qvred has a
Fixed status but Known Fixed Releases is empty. That means that developers have
resolved the issue ; but it is not yet incorporated in production release for customers.
Contact TAC to get an ETA (or ask for interim solution(version))

topic CSCwo94394 - Remove unsafe directives Content-Security-Policy header in Network Security

CSCwo94394 - Remove unsafe directives Content-Security-Policy header

Re: CSCwo94394 - Remove unsafe directives Content-Security-Policy head