Cisco Says CVE-2026-20349 VPN Flaw Is Being Exploited to Crash Firewalls
Summary
Cisco says attackers are exploiting CVE-2026-20349 to remotely crash certain Secure Firewall ASA and FTD devices. No workaround exists; Cisco has released hot fixes and recommends upgrading.
Key points
- The high-severity vulnerability has a severity score of 8.6 and can cause an affected device to reload, resulting in denial of service.
- An attacker can exploit the flaw remotely without authentication or user interaction by sending a crafted HTTP request to the Remote Access SSL VPN service when SSL listen sockets are enabled.
- Affected configurations include IKEv2 Remote Access VPN with client services, SSL VPN, and Zero Trust Network Access on FTD devices; Secure Firewall Management Center is not affected.
- Cisco says it became aware of active exploitation in August 2026 but has not disclosed who is exploiting the flaw or which organizations are targeted.
- Cisco has released hot fixes for specified ASA and FTD software releases and recommends upgrading to a fixed release; no workaround is available.
Article Details
- Vulnerability Types
- Denial of service
- Insufficient error checking while processing HTTP requests
- Severity
- High (8.6)
- Affected Versions
- Secure Firewall ASA 9.16
- Secure Firewall ASA 9.18
- Secure Firewall ASA 9.20
- Secure Firewall ASA 9.22
- Secure Firewall ASA 9.23
- Secure Firewall ASA 9.24
- FTD 7.0
- FTD 7.2
- FTD 7.4
- FTD 7.6
- FTD 7.7
- FTD 10.0
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available