CVE-2026-20349 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-08-11

Added to CISA KEV: 2026-08-11 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
CRITICAL: This vulnerability is in CISA KEV with confirmed active exploitation — review ASA/FTD logs, crash dumps, and syslogs for repeated unexpected reloads or crash indicators associated with SSL VPN service processing
Apply Cisco's fixed software releases immediately per the cisco-sa-asaftd-vpn-dos-dzv4mQFF advisory
If immediate patching is not possible, consider restricting access to the Remote Access SSL VPN interface via ACLs to trusted source IPs where feasible, or disable Remote Access SSL VPN temporarily if not business-critical
Monitor for repeated device reload alerts, unusual crash telemetry, or anomalous HTTP requests targeting the VPN service via Cisco Firepower Management Center/monitoring tools
Patch priority: CRITICAL/URGENT given KEV listing and internet-facing nature of the affected service

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-20349 is a high-severity heap inspection vulnerability affecting the Remote Access SSL VPN service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The flaw matters significantly because it is actively being exploited in the wild to crash vulnerable devices, causing an unexpected reload and a resulting denial-of-service (DoS) condition, which disrupts critical network security and connectivity for organizations relying on these appliances.

Exploitation

Active Exploitation: The vulnerability is confirmed as actively exploited in the wild, with Cisco PSIRT and CISA tracking it as a known exploited vulnerability since August 2026 ^[5]^[6].
Threat Actors: While specific named threat actor groups have not been widely publicized, the exploitation pattern of crashing network edge devices is characteristic of campaigns aiming to cause service disruption ^[4].
Tooling: Attackers exploit the vulnerability by sending specially crafted HTTP requests to the targeted device ^[4].
Prerequisites: The attack is network-based and does not require authentication or user interaction to trigger, making it particularly dangerous for internet-facing VPN services ^[1].

Affected Products & Patches

Affected Products: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software that have the Remote Access SSL VPN service, IKEv2 client services, or ZTNA functionality enabled ^[2]^[7].
Patch Availability: Cisco has released software updates to remediate the vulnerability; organizations are strongly advised to upgrade to the fixed releases provided by Cisco ^[5].
Mitigation: If immediate patching is not possible, organizations should verify their software versions and prioritize the remediation of appliances where Remote Access SSL VPN or related services are exposed to the internet ^[2].

Impact

Capability: Successful exploitation allows an unauthenticated remote attacker to force the affected firewall to reload, effectively creating a denial-of-service condition that renders the VPN service unavailable ^[1].
Business Risk: For internet-facing deployments, this vulnerability represents a critical risk of service outage, blocking remote workers from accessing internal resources and disrupting business continuity. Additionally, because the vulnerability allows the appliance to be crashed, it may be used to stage further attacks or bypass security perimeters ^[3].

Sources

CVE-2026-20349 - Vulnerability Details - OpenCVE
A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Show moreShow less Published: 2026-08-11 Score:8.6 High EPSS:2.2% Low KEV:Yes Impact:Denial of Service Action:Patch Now…
CVE-2026-20349: Cisco ASA and FTD VPN DoS Flaw
CVE-2026-20349 is a high-severity denial-of-service vulnerability in the Remote Access SSL VPN service of Cisco ASA and Secure FTD Software. ... CVE-2026-20349 detection should start with identifying exposed ASA and FTD appliances, verifying their software versions, and determining whether Remote Ac…
CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk ...
Patching CVE-2026-20349 does not tell you whether an attacker already used this flaw, or a prior one, to stage something inside your perimeter. As in the recent FortiBleed incident or the Fairlife ransomware cyberattack, a patched appliance can still be weaponized, so you need monitoring that goes b…
CVE-2026-20349 is actively being exploited. ...
CVE-2026-20349 is officially seeing active exploitation. Threat actors are sending crafted HTTP requests that force the devices to reload. No ...
Cisco Security Advisory: Cisco Secure Firewall Adaptive Security ...
Exploitation and Public Announcements In August 2026, the Cisco Product Security Incident Response Team (PSIRT) became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.

🔴 CVE-2026-20349