Cisco has disclosed a high-severity vulnerability in Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software that is already being exploited in the wild. Tracked as CVE-2026-20349, the flaw carries a CVSS score of 8.6 and allows an unauthenticated remote attacker to force an affected firewall to reload, resulting in a denial-of-service (DoS) condition.
The security issue is caused by insufficient error checking when Cisco devices process specially crafted HTTP requests through the Remote Access SSL VPN service. No authentication or user interaction is required, making internet-facing VPN gateways particularly attractive targets for disruption.
The vulnerability impacting Secure Firewall Adaptive Security Appliance and FTD products becomes exploitable when specific remote-access functionality enables SSL listen sockets. A successful attack can abruptly restart the affected security appliance, interrupting VPN connectivity and potentially disrupting access to business-critical networks and services.
Cisco’s Product Security Incident Response Team (PSIRT) became aware of active exploitation in August 2026. Following confirmation of attacks, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog and ordered U.S. federal civilian agencies to remediate it by August 14, 2026.
CVE-2026-20349 analysis
The vulnerability resides in the Remote Access SSL VPN functionality implemented by Cisco ASA and FTD software. Cisco attributes the issue to inadequate error checking while processing HTTP requests sent to the service. An attacker can remotely send a specially crafted request that triggers an unexpected device reload.
The most important details for CVE-2026-20349 are that exploitation requires neither valid credentials nor interaction from an administrator or VPN user. According to Cisco’s CVSS vector, the attack can be conducted remotely over the network, has low attack complexity, requires no privileges, and primarily impacts availability.
CVE-2026-20349 affects Cisco ASA or FTD installations running vulnerable software when at least one of the following configurations is enabled:
- IKEv2 Remote Access VPN with client services, configured with crypto ikev2 enable client-services port
- SSL VPN, configured through webvpn and enable
- Zero Trust Network Access, configured with zero-trust enable on supported FTD systems
Zero Trust Network Access is relevant only to Secure FTD Software. Cisco Secure Firewall Management Center (FMC) itself is not affected by the vulnerability.
From an attacker’s perspective, the vulnerability provides a comparatively simple way to disrupt an edge security appliance. Because remote-access VPN services are frequently exposed directly to the internet by design, an adversary does not first need to compromise an internal workstation or acquire VPN credentials. A crafted HTTP request sent directly to the vulnerable service may be sufficient to crash and reload the appliance.
Repeated exploitation could therefore interrupt VPN sessions and temporarily prevent remote employees, administrators, or third-party users from reaching protected resources. For organizations where an ASA or FTD appliance operates as an important network gateway, repeated reloads could have a broader operational impact even though Cisco has not described the flaw as enabling code execution, information theft, or persistent device compromise.
Cisco said it discovered the vulnerability during internal security testing. Security researcher Valerio Brussani independently identified and reported the same issue to the company. Cisco has not disclosed when either discovery originally occurred, but the public advisory was released on August 11, 2026.
No public CVE-2026-20349 PoC was identified in Cisco’s advisory or the two cited reports at disclosure. Nevertheless, confirmed in-the-wild exploitation demonstrates that at least one threat actor already possesses a working method for exploitation of the vulnerability.
Cisco has also not provided information about the attackers, their geographic origin, targeted organizations, or the scope of successful attacks. The available reporting therefore does not establish whether the activity is associated with cybercrime, espionage, hacktivism, or opportunistic scanning.
There are currently no vendor-published CVE-2026-20349 IOCs tied specifically to the observed exploitation. This increases the importance of behavioral monitoring, device-health telemetry, HTTP request analysis, and investigation of unexpected firewall reloads rather than relying solely on conventional hashes, IP addresses, or domains.
CVE-2026-20349 Mitigation
Cisco states that there are no workarounds that fully address the vulnerability. Organizations running affected configurations should install the vendor-provided hot fixes or upgrade to a fixed software release as soon as possible.
For Cisco ASA, hot fixes are available for the following branches:
- ASA 9.16: 89.16.4.50
- ASA 9.18: 89.18.4.50
- ASA 9.20: 9.20.4.235
- ASA 9.22: 9.22.3.191
- ASA 9.23: 9.23.1.211
- ASA 9.24: 9.24.1.221
Cisco notes that organizations installing the 9.16 or 9.18 hot fixes should use ASDM 7.24.1.374 because older ASDM versions do not recognize the new 89.x ASA release-numbering format.
Cisco has also released branch-specific hot fixes for Secure FTD versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. Because the exact package depends on the FTD release and appliance platform, administrators should use Cisco’s security advisory and Software Checker to determine the appropriate update for each device.
CVE-2026-20349 detection should start with identifying exposed ASA and FTD appliances, verifying their software versions, and determining whether Remote Access SSL VPN, IKEv2 client services, or ZTNA functionality is enabled. Systems meeting both conditions should receive the highest remediation priority.
To Detect CVE-2026-20349 activity, defenders should investigate:
- Unexpected ASA or FTD reloads with no corresponding administrative maintenance
- Repeated device restarts occurring shortly after inbound HTTP or HTTPS traffic
- Abnormal request bursts against internet-facing Remote Access VPN interfaces
- Connection spikes or malformed requests immediately before a device crash
- Repeated VPN outages originating from the same external sources
- Availability alerts involving otherwise healthy ASA or FTD appliances
These signals are not definitive proof of exploitation. However, when they appear on an unpatched internet-facing device configured with vulnerable VPN services, organizations should treat them as potentially suspicious and correlate firewall, VPN, network, and upstream proxy telemetry.
Since confirmed attacks are already occurring, CVE-2026-20349 mitigation should not rely solely on monitoring. Applying Cisco’s fixed software is the only vendor-supported way to fully remediate the vulnerability.
Organizations should also prioritize edge appliances over less-exposed systems during emergency patching. VPN gateways sit directly on the network perimeter and play a critical availability role, meaning successful exploitation can disrupt remote connectivity even without compromising confidentiality or integrity.
FAQ
What is CVE-2026-20349 and how does it work?
CVE-2026-20349 is a high-severity denial-of-service vulnerability in the Remote Access SSL VPN service of Cisco ASA and Secure FTD Software. Insufficient error checking when processing HTTP requests allows an unauthenticated remote attacker to send a crafted request that forces an affected device to reload.
When was CVE-2026-20349 first discovered?
Cisco has not publicly disclosed the original discovery date. The company identified the issue during internal security testing, while security researcher Valerio Brussani independently reported it. Cisco published its security advisory on August 11, 2026 and confirmed that PSIRT had become aware of active exploitation during August.
What is the impact of CVE-2026-20349 on systems?
Successful exploitation forces an affected ASA or FTD device to reload, creating a DoS condition. This can terminate active VPN sessions and interrupt access to networks and applications that rely on the firewall or VPN gateway for connectivity. Cisco has not indicated that the flaw allows remote code execution or data theft.
Can CVE-2026-20349 still affect me in 2026?
Yes. Any unpatched Cisco ASA or FTD appliance running a vulnerable software release with one of the affected remote-access configurations can remain exposed. The risk is immediate because Cisco has confirmed active exploitation, and CISA has added the vulnerability to its KEV catalog.
How can I protect myself from CVE-2026-20349?
Install the appropriate Cisco ASA or FTD hot fix or upgrade to a fixed software release immediately. Cisco states that no workaround fully addresses the vulnerability. Administrators should also verify which devices expose Remote Access SSL VPN functionality and investigate unexplained firewall reloads or abnormal HTTP traffic targeting VPN interfaces.