Cisco — High-Severity Remote DoS Vulnerability Actively Exploited in ASA and FTD (CVE-2026-20349)

Publication date: August 12, 2026
Category: Network Security / Vulnerability

Introduction

Cisco has issued an urgent warning following the detection of active, in-the-wild exploitation targeting a critical vulnerability affecting Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. Tracked as CVE-2026-20349, this high-severity flaw carries a CVSS score of 8.6 and allows an unauthenticated, remote attacker to trigger an unexpected device reload, leading directly to a denial-of-service (DoS) condition. The defect was uncovered during internal security testing and independently reported by researcher Valerio Brussani, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to immediately add the flaw to its Known Exploited Vulnerabilities (KEV) catalog.

What is CVE-2026-20349? (General Analysis)

CVE-2026-20349 is an insufficient error checking vulnerability occurring during the processing of HTTP requests within the Remote Access SSL VPN service of Cisco security firewalls. Such security defects, formally classified under CWE-244 (Improper Control of Dynamically-Managed Code or related runtime flow error management flaws), typically manifest when an application fails to robustly validate anomalous or malformed input received across exposed networking protocols.

• Official CVSS Score (v3.1): 8.6 (HIGH)
• Official CVSS Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H (Confirmed NVD data)
• Official CWE Classification: CWE-244 (Confirmed NVD data)
• CISA KEV Status: Included (Actively exploited in the wild)

Given that ASA and FTD appliances serve as critical enterprise security perimeters, the sudden interruption of their VPN services deprives organizations of secure remote connectivity, disrupting operational continuity and compromising edge availability.

How Does It Work? (Technical Analysis)

The exploitation mechanism relies on interacting directly with the daemon or service responsible for managing Remote Access SSL VPN connections and associated tunnels on the edge device.

• Initial Exploit Entry Flow: An attacker transmits a specially crafted, maliciously constructed HTTP request directly toward the port or interface enabled for the Remote Access SSL VPN service on the targeted appliance, requiring no valid credentials or prior privileges.
• Error Processing Flaw: Lacking strict error verification routines during the parsing or handling of the incoming HTTP request, the firewall operating system’s internal code encounters a critical runtime exception when attempting to process the anomalous parameters.
• Denial of Service Effect: The unhandled exception or induced subsystem crash forces an emergency device reload or hardware/VM panic to prevent broader kernel corruption, resulting in total loss of communication channels and the disconnection of all legitimate users.

Affected Systems / Environments

Organizations operating Cisco security appliances running vulnerable versions of ASA and FTD with specific VPN or remote access configurations are exposed.

Vulnerability Summary Table

Vulnerable Configurations and Versions

The defect manifests when devices have one or more of the following service configurations enabled:

• IKEv2 Remote Access VPN (with client services enabled): crypto ikev2 enable <interface_name> client-services port <port_numbers>
• SSL-VPN: webvpn enable <interface_name>
• Zero Trust Network Access: zero-trust enable

Affected ASA Versions:

• ASA 9.16 (Fixed in 9.16.4.50)
• ASA 9.18 (Fixed in 9.18.4.50)
• ASA 9.20 (Fixed in 9.20.4.235)
• ASA 9.22 (Fixed in 9.22.3.191)
• ASA 9.23 (Fixed in 9.23.1.211)
• ASA 9.24 (Fixed in 9.24.1.221)

Affected FTD Versions:

• FTD 7.0 (Requires specific hotfix, e.g., Cisco_FTD_Hotfix_GC-7.0.9.1-1.sh.REL.tar)
• FTD 7.2 (Requires specific hotfix, e.g., Cisco_FTD_Hotfix_HM-7.2.11.1-2.sh.REL.tar)
• FTD 7.4 (Requires specific hotfix, e.g., Cisco_FTD_Hotfix_HK-7.4.7.1-1.sh.REL.tar)
• FTD 7.6 / 7.7 / 10.0 (Require their respective software upgrade packages or hotfixes provided in the vendor advisory).

Mitigation and Detection

Remediation

Cisco has confirmed that no workaround solutions exist to address the flaw without disabling core business features, making the deployment of official software patches or hotfixes supplied by the vendor the sole effective remediation path. U.S. government agencies (FCEB) have been mandated to apply patches prior to August 14, 2026, due to active exploitation risks reflected in CISA’s KEV.

Detection

Defensive teams (Blue Teams) must enforce rigorous monitoring regarding the operational health and status of perimeter Cisco ASA/FTD devices:

• Log Analysis and Telemetry: Monitor system logs for unexpected reloads (reload reasons indicating software faults or kernel exceptions), alongside anomalous traffic spikes of HTTP requests targeting the SSL VPN interface port.
• Perimeter Traffic Inspection: Configure IDS/IPS signature rules at the network boundary to detect anomalous or malformed HTTP requests aimed at Cisco remote access endpoints.

“The exploitation of denial-of-service vulnerabilities in edge gateways such as Cisco ASA and FTD poses an immediate tactical risk to the operational continuity of critical infrastructure, demanding absolute prioritization of official vendor patches.”

Wrapping Up

The identification and active in-the-wild exploitation of vulnerability CVE-2026-20349 highlights the persistent attack surface represented by corporate edge devices and VPN gateways. By enabling unauthenticated remote attackers to crash and reboot enterprise firewalls via manipulated HTTP requests, the flaw jeopardizes perimeter stability. In the absence of alternative workarounds, immediate upgrading to patched software versions and hotfixes provided by Cisco stands as a critical priority for defensive security.

References

• [Vendor Advisory] Cisco Systems. (2026). Cisco Secure Firewall ASA and FTD Software Remote Access SSL VPN Denial of Service Vulnerability. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF
• [US Government Resource] Cybersecurity and Infrastructure Security Agency (CISA). (2026). CISA Adds Three Known Exploited Vulnerabilities to Catalog. https://www.cisa.gov/news-events/alerts/2026/08/11/cisa-adds-three-known-exploited-vulnerabilities-catalog
• [US Government Resource] Cybersecurity and Infrastructure Security Agency (CISA). (2026). Known Exploited Vulnerabilities Catalog (CVE-2026-20349). https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20349
• [Source Article] The Hacker News. (2026). Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS. https://thehackernews.com/2026/08/cisco-asa-and-ftd-flaw-exploited-in-the-wild-can-trigger-remote-dos.html