Cisco disclosed on August 11, 2026 that a denial-of-service vulnerability in the Remote Access SSL VPN service of its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software is under active exploitation. CISA added the flaw, tracked as CVE-2026-20349, to its Known Exploited Vulnerabilities catalog within a day of the advisory, giving federal civilian agencies until August 14 to remediate.

What happened

The vulnerability lives in how the Remote Access SSL VPN service on ASA and FTD parses incoming HTTP requests. Insufficient error checking during heap memory handling means a single crafted, unauthenticated HTTP request sent to a device’s VPN-facing interface can trigger a fault severe enough to force an unscheduled reload — no credentials, no user interaction, and no prior foothold required. Cisco’s PSIRT says it became aware of active exploitation in August 2026 but has not disclosed who is behind the attacks, how many devices have been hit, or whether exploitation is opportunistic scanning or targeted. This lands on the heels of a string of ASA/FTD zero-days exploited by state-linked actors over the past two years, and Cisco’s own advisory references it as part of a pattern of “continued attacks against Cisco firewalls.”

Technical details

  • CVE: CVE-2026-20349 — heap inspection vulnerability in the Remote Access SSL VPN service
  • CVSS: 8.6 (High), AV:N/AC:L/PR:N/UI:N — network-exploitable, low complexity, no privileges or user interaction needed
  • Affected products: Cisco Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software, on devices with Remote Access SSL VPN enabled and reachable
  • Mechanism: a crafted HTTP request to the SSL VPN service triggers insufficient error handling on the heap, crashing the process and forcing the appliance to reload
  • Impact of successful exploitation: denial of service — the firewall/VPN gateway drops offline and reloads, severing VPN connectivity and any traffic the appliance was mediating until it comes back up
  • Authentication required: none
  • Workaround: none published — Cisco states there is no interim mitigation short of disabling the exposed service or restricting access to it
  • KEV status: added by CISA on August 11–12, 2026, with a federal remediation deadline of August 14, 2026

Impact

ASA and FTD sit at the network edge as VPN concentrators and firewalls for a huge base of enterprises, and repeated, forced reloads of that hardware are more than a nuisance — each reload severs every active remote-access VPN session, briefly drops perimeter enforcement while the device reboots, and can be triggered repeatedly by an attacker with zero access to the target network beyond the exposed VPN endpoint. For organizations that depend on ASA/FTD as their primary remote-access path — including many that just went through emergency patching cycles for earlier ASA/FTD zero-days — this is a low-effort way for an attacker to degrade availability at will, and a plausible precursor to more serious exploitation research given Cisco firewalls’ history as a target for state-linked intrusion sets.

Mitigation

  • Patch immediately. Cisco has published fixed software; consult the advisory for the specific train and version that addresses your deployment, and treat this with the same urgency as the federal August 14 deadline implies.
  • There is no workaround — disabling or restricting access to the Remote Access SSL VPN service on affected devices is the only interim option if patching cannot happen immediately, but this also removes remote access for legitimate users.
  • Restrict exposure of the SSL VPN service to known source ranges wherever your architecture allows it, reducing the pool of hosts that can send a crafted request in the first place.
  • Monitor for unexpected reloads of ASA/FTD appliances — repeated, unscheduled reload events in your syslog or SNMP traps are the primary observable signal of exploitation attempts against this flaw.
  • Review Cisco’s “Continued Attacks Against Cisco Firewalls” advisory for broader indicators, since this DoS flaw is being tracked alongside other ongoing ASA/FTD exploitation activity rather than in isolation.

Sources: The Hacker News — Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS, BleepingComputer — Cisco warns of ASA and FTD VPN flaw exploited to crash devices, SecurityWeek — Cisco Patches Firewall Zero-Day Exploited for DoS Attacks, Cisco — Continued Attacks Against Cisco Firewalls, CISA — Known Exploited Vulnerabilities Catalog: CVE-2026-20349.