CVE-2026-20349 hits Cisco ASA

CISA added CVE-2026-20349 to its Known Exploited Vulnerabilities catalog, and the issue has already been flagged as actively exploited in Cisco Secure Firewall ASA and FTD. The flaw affects remote-access SSL VPN services and can let an unauthenticated remote attacker force the device to reboot, resulting in a denial of service.

What does this vulnerability do in Cisco ASA and FTD?

CVE-2026-20349 is described as a heap inspection issue and insufficient error checking while processing HTTP requests. According to the Canadian Centre for Cyber Security, that can cause a Cisco ASA or FTD device to reboot, leaving it unavailable.

Tenable places it in the Remote Access SSL VPN service and says an unauthenticated remote attacker can send a specially crafted HTTP request to trigger the reboot. NVD describes it in the same terms, and CVETodo classifies it as high severity, with a CVSS score of 8.6 out of 10.

What configurations are exposed?

A device is exposed if it runs a vulnerable version and has services enabled that open SSL sockets, especially IKEv2 Remote Access VPN with client services, SSL VPN or WebVPN, and Zero Trust Network Access, the last one only on FTD. Cisco, according to CyCognito, identifies those three configurations as the ones that expand the exposure surface.

Cataam also specifies that the vulnerability only affects systems with remote-access VPN enabled on an Internet-facing interface. Help Net Security agrees that the scope is not general, but depends on the affected version and on whether any of those services are active.

What did Cisco and response teams say?

Cisco published an advisory on August 11, 2026 and, according to CyCognito, its PSIRT team was already aware of active exploitation at that time. The Canadian Centre for Cyber Security said in advisory AV26-807 that CISA added CVE-2026-20349 to the KEV catalog on August 11, 2026.

HKCERT also included it in its bulletin on multiple Cisco product vulnerabilities and described it as a flaw under active exploitation in the environment. Help Net Security noted that under BOD 26-04, U.S. civilian federal agencies had to remediate it by August 14, 2026.

Are there patches or mitigation options?

Cisco released hotfixes for several ASA and FTD branches, including ASA 9.16, 9.18, 9.20, 9.22, 9.23 and 9.24, and FTD 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0. Help Net Security, Cataam and Cybersecurity Dive all say there are no workarounds, and the response is to install the corrected versions.

Cataam adds that, for devices that do not need the feature, the operational alternative is to disable remote-access SSL VPN. Cybersecurity Dive also reported that Cisco strongly advised customers to upgrade to the fixed releases.