[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8KYysSiX7ocrnzs4ORm86wdi3UpB05ljwd5fpAAUQEY":3,"$fElovgypxGagie2I5UFd0dTfzLnKkMgVkufNd3WrFSNo":51},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":47,"created_at":48,"updated_at":49,"published_at":50},"cisco-asa-and-ftd-vpn-dos-flaw-actively-exploited-in-the-wild","Cisco ASA and FTD VPN DoS Flaw Actively Exploited in the Wild","Unauthenticated remote attacker can force a device reload via a crafted HTTP request to the Remote Access SSL VPN service, scoring CVSS 8.6.","Cisco PSIRT confirmed active exploitation of CVE-2026-20349 in August 2026, a High-severity DoS in the Remote Access SSL VPN service of Secure Firewall ASA and FTD software that lets an unauthenticated remote attacker trigger an unexpected device reload.",[10,11,12,13,14,15],"cisco","asa","ftd","ssl-vpn","dos","cve-2026-20349","# Cisco ASA and FTD VPN DoS Flaw Actively Exploited in the Wild\n\n*Unauthenticated remote attacker can force a device reload via a crafted HTTP request to the Remote Access SSL VPN service, scoring CVSS 8.6.*\n\n**Tags:** `cisco` `asa` `ftd` `ssl-vpn` `dos` `cve-2026-20349`\n\n> Cisco PSIRT confirmed active exploitation of CVE-2026-20349 in August 2026, a High-severity DoS in the Remote Access SSL VPN service of Secure Firewall ASA and FTD software that lets an unauthenticated remote attacker trigger an unexpected device reload.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | Vector | KEV added |\n|---|---|---|---|\n| CVE-2026-20349 | 8.6 | AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:N\u002FI:N\u002FA:H | 11 Aug 2026 |\n\n## Cisco ASA\u002FFTD VPN DoS actively exploited\n\nCVE-2026-20349 is a High-severity denial-of-service vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Cisco published its advisory on 11 August 2026. The flaw, rated CVSS 8.6, allows an unauthenticated remote attacker to send a crafted HTTP request that forces the device to reload unexpectedly.\n\nCisco says: \"In August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.\" It has not named a threat actor, campaign or target sector. CISA added the CVE to its Known Exploited Vulnerabilities catalogue on 11 August 2026, with a remediation deadline of 14 August 2026 for US federal civilian agencies.\n\n## How the flaw works\n\nThe root cause is insufficient error checking when the SSL VPN service processes HTTP requests; Cisco maps it to CWE-244. No credentials or user interaction are required. A successful request reloads the device, interrupting service. Cisco has not described the flaw as enabling code execution or data theft.\n\n## Which configurations are affected\n\nA device is affected when it runs a vulnerable ASA or FTD release with one of these features enabled (that is, with SSL listen sockets active), as shown by `show running-config`:\n\n- IKEv2 Remote Access VPN with client services: `crypto ikev2 enable \u003Cinterface_name> client-services port \u003Cport_numbers>`\n- SSL VPN: `webvpn` with `enable \u003Cinterface_name>`\n- Zero Trust Network Access (FTD only): `zero-trust enable`\n\nCisco Secure Firewall Management Center (FMC) software is not affected.\n\n## Fixed releases\n\nCisco says there are no workarounds. Its advisory lists these first fixed releases:\n\n| ASA train | First fixed | FTD train | First fixed |\n|---|---|---|---|\n| 9.16 and earlier | 9.16.4.103 | 7.0 and earlier | 7.0.10 |\n| 9.18 | 9.18.4.94 | 7.2 | 7.2.12 |\n| 9.20 | 9.20.4.49 | 7.4 | 7.4.8 |\n| 9.22 | 9.22.3.26 | 7.6 | 7.6.6 |\n| 9.23 | 9.23.1.47 | 7.7 | 7.7.13 |\n| 9.24 | 9.24.1.26 | 10.0 | 10.0.2 |\n\nHot fixes were released at disclosure for ASA 9.16, 9.18, 9.20, 9.22, 9.23 and 9.24 and FTD 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0. Cisco's updated advisory says those hot fixes have been superseded by the releases above.\n\n## Detection\n\nCisco lists Snort rules 46897 and 59654 for this vulnerability. They are not a substitute for upgrading. Cisco has not published indicators of compromise (hashes, IP addresses or domains) for the observed exploitation, so unexpected reloads of VPN-facing ASA or FTD devices are the main signal to investigate.\n\nCisco found the issue during internal security testing; researcher Valerio Brussani also reported it.\n\n## Key points\n\n- CVE-2026-20349 is a High-severity DoS (CVSS 8.6) in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD software.\n- An unauthenticated remote attacker sends a crafted HTTP request to force an unexpected device reload.\n- Cisco PSIRT confirmed active exploitation in August 2026; CISA added it to KEV on 11 August with a 14 August 2026 deadline.\n- Affected configurations are IKEv2 Remote Access VPN with client services, SSL VPN and (FTD only) Zero Trust Network Access.\n- There is no workaround; upgrade to the fixed ASA or FTD release for your train. Cisco lists Snort rules 46897 and 59654.\n\n## Further reading & sources\n\n- [Cisco Secure Firewall ASA and FTD Remote Access SSL VPN Denial of Service Vulnerability](https:\u002F\u002Fsec.cloudapps.cisco.com\u002Fsecurity\u002Fcenter\u002Fcontent\u002FCiscoSecurityAdvisory\u002Fcisco-sa-asaftd-vpn-dos-dzv4mQFF) (Cisco)\n- [Cisco fixes vulnerability exploited to DoS its firewalls (CVE-2026-20349)](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F08\u002F13\u002Fcve-2026-20349-cisco-firewalls-dos\u002F) (Help Net Security)\n- [CVE-2026-20349: Cisco ASA and FTD VPN DoS Flaw](https:\u002F\u002Fsocprime.com\u002Fblog\u002Fcve-2026-20349-actively-exploited-cisco-asa-and-ftd-flaw-enables-remote-dos) (SOC Prime)\n","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisco-asa-and-ftd-vpn-dos-flaw-actively-exploited-in-the-wild.png?v=d65d86c076",{"cves":19,"timeline":30,"technologies":39},[20],{"id":21,"kev":22,"poc":23,"url":24,"cvss":25,"epss":26,"risk_band":27,"risk_score":28,"cvss_version":29},"CVE-2026-20349",true,false,"\u002Fvulnerabilities\u002FCVE-2026-20349",8.6,0.0101,"High",74.54,"3.1",[31,35],{"date":32,"event":33,"description":34},"2026-08","Active exploitation","Cisco PSIRT says it became aware of active exploitation of CVE-2026-20349 in August 2026.",{"date":36,"event":37,"description":38},"2026-08-11","Advisory published","Cisco published its security advisory on August 11, 2026",[40,43,45],{"vendor":41,"product":42},"Cisco","Secure Firewall Adaptive Security Appliance (ASA)",{"vendor":41,"product":44},"Secure Firewall Threat Defense (FTD)",{"vendor":41,"product":46},"Secure Firewall ASA","vulnerability_disclosure","2026-08-27T07:05:36.52841+00:00","2026-10-16T12:29:17.659703+00:00",null,{"articles":52},[53,66,79,90],{"slug":54,"title":55,"summary":56,"tags":57,"hero_image_url":64,"story_type":47,"created_at":65},"fortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation","Fortinet FortiMail Zero-Day CVE-2026-104286 Under Active Exploitation","Fortinet disclosed a critical FortiMail zero-day, CVE-2026-104286, on 1 October 2026. It is exploited in the wild, rated CVSS 9.8 by Fortinet, and was added to CISA's KEV catalog the same day. It affects FortiMail 7.2.0 through 8.0.1; fixes are in 7.4.9, 7.6.7 and 8.0.2.",[58,59,60,61,62,63],"Fortinet","FortiMail","CVE-2026-104286","Path Traversal","CISA KEV","Zero-Day","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation.png?v=fe5d35df3a","2026-10-17T12:03:14.799873+00:00",{"slug":67,"title":68,"summary":69,"tags":70,"hero_image_url":77,"story_type":47,"created_at":78},"red-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-","Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password","A critical flaw in the reset-credentials flow of Red Hat Build of Keycloak lets a remote, unauthenticated attacker skip the email verification step and set a new password for any user. Fixed builds are available for the 26.4 and 26.6 streams and upstream Keycloak 26.7.2; disabling \"Forgot password\" is the interim workaround.",[71,72,73,74,75,76],"Keycloak","Red Hat","CVE-2026-18963","CVSS 9.1","account takeover","password reset","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fred-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-.png?v=94dc54a17a","2026-09-30T12:09:12.456253+00:00",{"slug":80,"title":81,"summary":82,"tags":83,"hero_image_url":88,"story_type":47,"created_at":89},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-able N-central auth bypass CVE-2026-18556 with 3-day federal deadline","CISA added CVE-2026-18556, an authentication bypass in N-able N-central that allows unauthenticated administrative account takeover in versions through 2026.1, to its Known Exploited Vulnerabilities catalog on 4 August 2026, with a 7 August deadline for US federal civilian agencies.",[84,85,62,86,87],"CVE-2026-18556","N-Able N-Central","RCE","authentication bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66","2026-09-21T12:03:34.769619+00:00",{"slug":91,"title":92,"summary":93,"tags":94,"hero_image_url":100,"story_type":47,"created_at":101},"gitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di","Gitea RCE CVE-2026-60004 Exploited: diffpatch API Abused to Run Shell Commands","CVE-2026-60004 is a critical remote code execution flaw in Gitea's diffpatch API, fixed in Gitea 1.27.1 on 27 July 2026. An attacker with repository write access, which open self-registration lets anyone obtain, can install a Git hook and run commands as the Gitea service account. CISA added it to its KEV catalogue on 25 August 2026 after reports of miner-like payloads on unpatched servers.",[95,96,86,97,98,99],"Gitea","CVE-2026-60004","diffpatch","Git hooks","CVSS 9.8","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di.png?v=b4d72a9b81","2026-09-12T12:07:21.883073+00:00"]