Cisco informed customers on Tuesday that it has released patches for a zero-day vulnerability affecting firewalls running Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software.
The security hole, tracked as CVE-2026-20349, is related to the processing of HTTP requests.
A remote, unauthenticated attacker can cause an appliance to reload and enter a denial-of-service (DoS) condition by sending a specially crafted HTTP request to the Remote Access SSL VPN service.
The vulnerability was discovered internally by Cisco and also reported by an external researcher.
Cisco said it became aware of active exploitation in August 2026, but has not shared any information on the attacks involving CVE-2026-20349.
These types of vulnerabilities could allow threat actors to disrupt security appliances, potentially preventing them from detecting and blocking further malicious activity.
Cisco has urged customers to apply the available hotfixes as soon as possible.
CISA added CVE-2026-20349 to its Known Exploited Vulnerabilities (KEV) catalog on Tuesday, instructing federal agencies to patch it by August 14.
This is the 12th Cisco product bug with a 2026 CVE identifier added to the KEV list this year. While a majority are SD-WAN product flaws, threat actors have also exploited Unified CM and FMC vulnerabilities.
Related: Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC
Related: Cisco Patches Critical SD-WAN, IOS XE, FMC Vulnerabilities
Related: Microsoft Fixes 421 CVEs, One Exploited Zero-Day