Cisco Patches Actively Exploited Firewall Zero-Day That Can Cause DoS
Summary
Cisco released hotfixes for actively exploited CVE-2026-20349, which lets unauthenticated attackers trigger a denial-of-service condition on Secure Firewall ASA and FTD appliances via a crafted HTTP request to the Remote Access SSL VPN service.
Key points
- CVE-2026-20349 affects Cisco Secure Firewall ASA and FTD software.
- A remote, unauthenticated attacker can trigger an appliance reload and denial-of-service condition with a specially crafted HTTP request to the Remote Access SSL VPN service.
- Cisco said it became aware of active exploitation in August 2026 but did not share details about the attacks.
- Cisco released hotfixes and urged customers to apply them promptly.
- CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and set an August 14 patch deadline for federal agencies.
Article Details
- Vulnerability Types
- HTTP request processing vulnerability causing denial of service
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationA remote, unauthenticated attacker exploits the vulnerability by sending a specially crafted HTTP request to the Remote Access SSL VPN service.T1499.004 · Application or System ExploitationThe crafted request can cause the appliance to reload and enter a denial-of-service condition.
CVE
Vendors
Products
Secure Firewall Adaptive Security Appliance (ASA)it has released patches for a zero-day vulnerability affecting firewalls running Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software.Secure Firewall Threat Defense (FTD)affecting firewalls running Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software.