Answer Brief
Cisco has confirmed active exploitation of CVE-2026-20349 (CVSS 8.6), a high-severity vulnerability in ASA and FTD software allowing unauthenticated remote attackers to trigger device reload via crafted HTTP requests to SSL VPN services, resulting in denial-of-service. The flaw affects multiple versions of ASA and FTD with specific VPN configurations enabled, and has been added to CISA’s KEV catalog with a patch deadline of August 14, 2026 for U.S. federal agencies. No workarounds exist; mitigation requires applying vendor-provided hotfixes.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
Cisco became aware of active exploitation earlier this month
- 2
Cisco published advisory on CVE-2026-20349
- 3
Source article published by The Hacker News
- 4
Deadline for FCEB agencies to apply fixes per CISA KEV catalog
Executive Summary: Cisco has confirmed active exploitation of CVE-2026-20349 (CVSS 8.6), a high-severity vulnerability in ASA and FTD software allowing unauthenticated remote attackers to trigger device reload via crafted HTTP requests to SSL VPN services, resulting in denial-of-service. The flaw affects multiple versions of ASA and FTD with specific VPN configurations enabled, and has been added to CISA’s KEV catalog with a patch deadline of August 14, 2026 for U.S. federal agencies. No workarounds exist; mitigation requires applying vendor-provided hotfixes.
Why It Matters
Cisco’s confirmation of active exploitation of CVE-2026-20349 represents a significant and immediate threat to network security infrastructure globally. The vulnerability resides in the HTTP request processing logic of Secure Firewall ASA and FTD software, where insufficient error checking allows a remote, unauthenticated attacker to trigger a denial-of-service condition by causing the affected device to reload. This is particularly concerning because the exploit vector targets the Remote Access SSL VPN service—a commonly exposed interface in enterprise and government networks—meaning that systems intended to provide secure remote connectivity can be weaponized to disrupt availability. The flaw does not require authentication or privileged access, lowering the barrier for exploitation and increasing the risk of widespread disruption, especially in environments where SSL VPN is broadly deployed for remote work or third-party access. The technical mechanism involves sending a malformed HTTP request to the SSL VPN endpoint, which triggers a fault in error handling that leads to a system reload. While Cisco has not confirmed whether the exploit leads to arbitrary code execution or data exposure, the confirmed outcome—a device reload resulting in DoS—is sufficient to disrupt critical network services, including internet access, internal communications, and security monitoring. The absence of confirmed workarounds means that organizations must rely solely on patching, which places urgency on asset owners to identify and update affected systems promptly. The specificity of the vulnerable configurations—IKEv2 Remote Access VPN with client services, SSL-VPN, and Zero Trust Network Access—helps narrow the exposure scope, but these are precisely the features organizations enable to support secure remote access, creating a cruel irony where security features become attack vectors. Cisco has provided a detailed list of affected versions and corresponding fixed hotfixes across ASA and FTD releases, demonstrating a targeted remediation effort. Affected ASA versions include 9.161, 9.181, 9.20, 9.22, 9.23, and 9.24, each with a specified fixed version. Similarly, FTD versions 7.0 through 10.0 are impacted, with version-specific hotfixes named according to Cisco’s internal naming convention (e.g., Cisco_FTD_Hotfix_GC-7.0.9.1-1.sh.REL.tar for FTD 7.0). The existence of these hotfixes confirms that the vulnerability is isolated to specific code paths and can be resolved without requiring a full platform upgrade, which is beneficial for operational continuity. However, the sheer number of affected versions and the granularity of the fixes increase the complexity of patch management, particularly in large or heterogeneous environments. The decision by CISA to include CVE-2026-20349 in the KEV catalog underscores the perceived severity and active threat posed by this flaw. By mandating that FCEB agencies apply patches by August 14, 2026—just two days after the advisory—CISA signals confidence that exploitation is not only occurring but poses a clear and present danger to federal infrastructure. This rapid timeline reflects the agency’s prioritization of known exploited vulnerabilities in high-risk devices, especially those at the network perimeter. While the source does not specify which sectors or organizations have been targeted in the wild, the inclusion in KEV implies that attacks have been observed in real-world scenarios, even if details about threat actors, victimology, or attack success remain undisclosed. From an operational standpoint, security and network teams must immediately verify whether their ASA or FTD devices are running affected versions and have the relevant VPN features enabled. Asset inventory tools, version scanning, and configuration audits should be prioritized to identify exposure. Given the lack of public detail on exploitation tactics, monitoring for unusual HTTP traffic to SSL VPN endpoints or unexpected device reloads may help detect ongoing attempts. Organizations should also review VPN access logs for anomalies, though the absence of authentication in the exploit vector limits visibility into attacker identity. The vulnerability highlights the ongoing risk posed by complex, feature-rich network security appliances, where the very services designed to protect connectivity can introduce critical availability risks if not properly maintained. Finally, while this vulnerability does not appear to be tied to a specific region or threat actor campaign, its global relevance is undeniable. Network security appliances like Cisco ASA and FTD are foundational components in enterprise, government, and critical infrastructure networks worldwide. A flaw that can disrupt these devices via a simple, unauthenticated HTTP request has the potential to cause cascading outages, especially in environments with high reliance on SSL VPN for remote operations. As such, this incident serves as a reminder of the importance of timely patching, configuration hygiene, and layered defense strategies—particularly for edge-facing services that must balance accessibility with security.
Event Type: security
Importance: high
Affected Companies
- Cisco
Affected Sectors
- cybersecurity
- infrastructure security
- network security
Key Numbers
- CVSS Score: 8.6
- CISA KEV Patch Deadline: August 14, 2026
- Affected ASA Versions: 9.161, 9.181, 9.20, 9.22, 9.23, 9.24
- Affected FTD Versions: 7.0, 7.2, 7.4, 7.6, 7.7, 10.0
Timeline
- Cisco became aware of active exploitation earlier this month
- Cisco published advisory on CVE-2026-20349
- Source article published by The Hacker News
- Deadline for FCEB agencies to apply fixes per CISA KEV catalog
Frequently Asked Questions
What is CVE-2026-20349 and what does it affect?
CVE-2026-20349 is a high-severity vulnerability (CVSS 8.6) in Cisco Secure Firewall ASA and FTD software caused by insufficient error checking when processing HTTP requests. It affects specific versions of ASA and FTD when IKEv2 Remote Access VPN with client services or SSL-VPN/Zero Trust Network Access is enabled.
How can attackers exploit this Cisco ASA and FTD flaw?
An unauthenticated remote attacker can exploit the flaw by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device, which may cause the device to reload and result in a denial-of-service condition.
Are there any workarounds for CVE-2026-20349?
No, Cisco has stated there are no workarounds that address the flaw. Mitigation requires applying the vendor-provided hotfixes for the affected ASA and FTD versions.
What action has CISA taken regarding this vulnerability?
CISA has added CVE-2026-20349 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the necessary fixes by August 14, 2026.
Who discovered and reported this vulnerability to Cisco?
Valerio Brussani is credited by Cisco for separately discovering and reporting the vulnerability, which was also found during Cisco’s internal security testing.