Vulnerability details
| CVE | CVSS | Vector | KEV added |
|---|---|---|---|
| CVE-2026-20349 | 8.6 | AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H | 11 Aug 2026 |
Cisco ASA/FTD VPN DoS actively exploited
CVE-2026-20349 is a High-severity denial-of-service vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Cisco published its advisory on 11 August 2026. The flaw, rated CVSS 8.6, allows an unauthenticated remote attacker to send a crafted HTTP request that forces the device to reload unexpectedly.
Cisco says: "In August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." It has not named a threat actor, campaign or target sector. CISA added the CVE to its Known Exploited Vulnerabilities catalogue on 11 August 2026, with a remediation deadline of 14 August 2026 for US federal civilian agencies.
How the flaw works
The root cause is insufficient error checking when the SSL VPN service processes HTTP requests; Cisco maps it to CWE-244. No credentials or user interaction are required. A successful request reloads the device, interrupting service. Cisco has not described the flaw as enabling code execution or data theft.
Which configurations are affected
A device is affected when it runs a vulnerable ASA or FTD release with one of these features enabled (that is, with SSL listen sockets active), as shown by show running-config:
- IKEv2 Remote Access VPN with client services:
crypto ikev2 enable <interface_name> client-services port <port_numbers> - SSL VPN:
webvpnwithenable <interface_name> - Zero Trust Network Access (FTD only):
zero-trust enable
Cisco Secure Firewall Management Center (FMC) software is not affected.
Fixed releases
Cisco says there are no workarounds. Its advisory lists these first fixed releases:
| ASA train | First fixed | FTD train | First fixed |
|---|---|---|---|
| 9.16 and earlier | 9.16.4.103 | 7.0 and earlier | 7.0.10 |
| 9.18 | 9.18.4.94 | 7.2 | 7.2.12 |
| 9.20 | 9.20.4.49 | 7.4 | 7.4.8 |
| 9.22 | 9.22.3.26 | 7.6 | 7.6.6 |
| 9.23 | 9.23.1.47 | 7.7 | 7.7.13 |
| 9.24 | 9.24.1.26 | 10.0 | 10.0.2 |
Hot fixes were released at disclosure for ASA 9.16, 9.18, 9.20, 9.22, 9.23 and 9.24 and FTD 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0. Cisco's updated advisory says those hot fixes have been superseded by the releases above.
Detection
Cisco lists Snort rules 46897 and 59654 for this vulnerability. They are not a substitute for upgrading. Cisco has not published indicators of compromise (hashes, IP addresses or domains) for the observed exploitation, so unexpected reloads of VPN-facing ASA or FTD devices are the main signal to investigate.
Cisco found the issue during internal security testing; researcher Valerio Brussani also reported it.
Key points
- CVE-2026-20349 is a High-severity DoS (CVSS 8.6) in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD software.
- An unauthenticated remote attacker sends a crafted HTTP request to force an unexpected device reload.
- Cisco PSIRT confirmed active exploitation in August 2026; CISA added it to KEV on 11 August with a 14 August 2026 deadline.
- Affected configurations are IKEv2 Remote Access VPN with client services, SSL VPN and (FTD only) Zero Trust Network Access.
- There is no workaround; upgrade to the fixed ASA or FTD release for your train. Cisco lists Snort rules 46897 and 59654.