cyber.hendryadrian.com

CVE

CVE-2026-20349

First Reported
Sep 8, 2026
Latest Reported
Sep 8, 2026
Articles
1
View articles →
IOC
0
View indicators →

CVE Enrichment

CVSS
8.6 HIGH
EPSS
1.01%
EPSS Percentile
62.15%
CISA KEV
YES — Known Exploited Vulnerability

Description

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.  This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

Technical Details

CVSS Version
3.1
CNA / NVD Source
psirt@cisco.com
Published
12-Aug-2026 00:17
Last Modified
17-Sep-2026 04:17
EPSS Date
2026-10-12
CWE
CWE-244

CVSS Vector

CVSS:3.1 AV:N / AC:L / PR:N / UI:N / S:C / C:N / I:N / A:H

CISA KEV Details

Date Added
2026-08-11
Remediation Due
2026-08-14
Known Ransomware Campaign Use
Unknown
Required Action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20349

Affected Products / Versions

References

Last enrichment sync: 12-Oct-2026 21:45
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE (71)

CVE-2010-39041 related articleCVE-2015-32461 related articleCVE-2015-52871 related articleCVE-2017-01991 related articleCVE-2017-57531 related articleCVE-2017-79211 related articleCVE-2019-10681 related articleCVE-2019-189351 related articleCVE-2020-07961 related articleCVE-2020-10131 related article

VIEW MORE

Malware (4)

BadIIS1 related articleNoodleRAT1 related articleQuasarRAT1 related articleSPECTRE1 related article

Threat Actors (1)

UAT-101471 related article

Vendors (22)

Alibaba Group1 related articleApache1 related articleApple1 related articleAtlassian1 related articleBroadcom1 related articleCisco1 related articleCitrix1 related articleF51 related articleFortinet1 related articleGitLab1 related article

VIEW MORE

Products (18)

AjaxPro1 related articleApache Tomcat1 related articleGitea1 related articleIBM Langflow1 related articleLangflow1 related articleMarimo1 related articleMetabase1 related articleMLflow1 related articlen8n1 related articleNacos1 related article

VIEW MORE

Tools (7)

DeepAudit1 related articleDeepSeek1 related articleEfsPotato1 related articleHermes Agent1 related articleMeterpreter1 related articleNuclei1 related articlePentestGPT1 related article

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.