Cisco Fixes Actively Exploited ASA and FTD Firewall DoS Flaw (CVE-2026-20349)

Active exploitation of a high-severity denial-of-service vulnerability in Cisco edge security devices has prompted emergency patching requirements across enterprise and government networks. The flaw, tracked as CVE-2026-20349, allows an unauthenticated remote attacker to cause an affected Cisco firewall to abruptly crash and reload by sending a malformed HTTP request. Because the vulnerability targets exposed Remote Access SSL VPN interfaces, any vulnerable appliance facing the public internet can be knocked offline without user interaction or valid credentials.

Cisco’s Product Security Incident Response Team (PSIRT) confirmed that active exploitation was observed in August 2026. The Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog, setting an expedited remediation deadline of August 14, 2026, for US federal civilian agencies.

Technical Analysis of CVE-2026-20349

The vulnerability exists within the HTTP processing logic of the Remote Access SSL VPN service common to Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software. When an affected device is configured to handle remote access connection services—specifically IKEv2 Remote Access VPN with client services, SSL VPN, or Zero Trust Network Access (ZTNA)—it binds active listening sockets on configured web ports to process incoming user sessions and authentication requests.

An attacker can exploit CVE-2026-20349 by sending a specially crafted HTTP request directly to these exposed SSL listen sockets. The underlying WebVPN parsing engine fails to properly handle or sanitize specific malformed structures within the incoming request headers or payload, triggering an unhandled exception or critical system crash in the primary control process (such as the core lina process on ASA/FTD). Because the system cannot recover gracefully from this fault, the security appliance immediately initiates an unexpected system reload to restore memory integrity.

Because the attack vector requires zero authentication and no user interaction, an attacker can continuously script and automate these HTTP requests, forcing affected firewalls into a continuous reboot loop and completely denying network availability.

Blast Radius and Operational Risks

Perimeter firewalls and security gateways represent single points of failure for corporate connectivity and network defense. The blast radius of an unauthenticated remote DoS vulnerability on edge appliances like Cisco ASA and FTD extends across several operational layers:

• Loss of Remote Workforce Connectivity: Organizations relying on Cisco ASA or FTD for remote access SSL VPN or ZTNA will experience complete session disruption. Active user tunnels are instantly dropped upon device reboot, severely impacting business operations and remote worker productivity.
• Perimeter Blackout and Outages: During the device reload cycle—which can take several minutes per appliance depending on hardware specifications and loaded signatures—all stateful packet inspection, routing, site-to-site IPsec tunnels, and network traffic enforcement cease entirely.
• Failure of High-Availability (HA) Pairs: Many enterprise deployments rely on active/standby or active/active High-Availability clusters. However, automated scanning scripts targeting public IP spaces routinely deliver the malicious HTTP request to all exposed interface addresses across primary and secondary nodes simultaneously. If both firewalls in an HA pair crash at the same time, failover mechanisms cannot prevent a total perimeter blackout.
• Distraction and Eviction Tactics: Threat actors frequently use targeted denial-of-service against perimeter security equipment as a tactical distraction. By forcing security devices to crash or flood event logs with system recovery diagnostics, attackers can blind security operation centers (SOC) or disrupt automated log telemetry while carrying out secondary intrusion activities elsewhere in the environment.

Affected Products and Software Versions

An appliance is vulnerable if it runs an affected version of Cisco ASA Software or FTD Software and has an active SSL listen socket configured for any of the following features:

• SSL VPN (AnyConnect / Cisco Secure Client)
• IKEv2 Remote Access VPN with client services enabled
• Zero Trust Network Access (ZTNA) application features

The flaw affects the following software branches:

• Cisco Secure Firewall ASA Software: Versions 9.16, 9.18, 9.20, 9.22, 9.23, and 9.24
• Cisco Secure Firewall FTD Software: Versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0

The vulnerability was discovered through a combination of internal security testing by Cisco engineers and external research reported by security researcher Valerio Brussani.

Remediation and Mitigation Guidance

There are no viable workarounds or temporary configuration toggles that mitigate CVE-2026-20349 without disabling essential remote access services entirely. Disabling SSL VPN or ZTNA features turns off the active listening sockets, but for most organizations, doing so would completely shut down legitimate remote access channels.

Network administrators must apply the software hotfixes released by Cisco for their respective release trains immediately:

1. Apply Software Hotfixes: Upgrade affected ASA units to fixed hotfix releases in the 9.16, 9.18, 9.20, 9.22, 9.23, or 9.24 lines. Upgrade FTD appliances to fixed hotfix builds across the 7.0, 7.2, 7.4, 7.6, 7.7, or 10.0 code paths.
2. Prioritize Edge Interfaces: Prioritize deployment on firewalls that expose SSL VPN web interfaces directly to untrusted public IP address ranges.
3. Monitor System Logs for Crashes: Audit crash dumps and reload reason logs on ASA and FTD firewalls (e.g., checking show crashinfo or system reload logs for unexpected process crashes related to webvpn or HTTP service daemons) to identify if your perimeter firewalls were targeted prior to patching.