CVE-2026-20349

What is Cisco Secure Firewall ASA / FTD?

Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) are among the most widely deployed enterprise perimeter firewall and remote-access VPN platforms. The affected component here is the Remote Access SSL VPN service — by definition internet-facing, since its job is to terminate employee VPN connections from anywhere.

Cisco edge VPN appliances have been under sustained state-sponsored targeting for years: the ArcaneDoor campaign against ASA in 2024, and repeated ASA/FTD entries in the KEV catalog through 2025 and 2026. They are attractive because they sit outside the corporate firewall, run opaque proprietary firmware that resists inspection, and offer very limited endpoint visibility. A denial of service against this component means the loss of remote-access VPN for an entire workforce.

Overview

CVE-2026-20349 allows an unauthenticated, remote attacker to force an affected device to reload by sending a specially crafted HTTP request to the Remote Access SSL VPN service. The result is a denial of service — and, because a single request suffices, an attacker able to reach the VPN interface can keep the appliance in a reload loop.

Cisco PSIRT became aware of active exploitation in August 2026, before the advisory published, making this a zero-day in practice. CISA assigned a three-day remediation deadline. There are no workarounds — Cisco states plainly that upgrading is the only remediation.

Impact is availability-only (C:N/I:N/A:H). There is no confirmed code execution or data disclosure associated with this vulnerability.

Affected Versions

A device is affected only if at least one of the following features is enabled. Checking this first can substantially narrow the patch set:

If none of these appear in the running configuration, the device is not vulnerable.

Cisco Secure Firewall ASA Software

Note on the 9.16 and 9.18 trains: the fixed-release build strings for these two trains render inconsistently across sources, including in the advisory's own fixed-release table. Confirm the exact build for 9.16 and 9.18 directly against the Cisco Software Checker or the advisory before scheduling those upgrades — do not rely on a transcribed version string.

Cisco Secure Firewall Threat Defense (FTD) Software — note that all of these are hotfix packages, not full maintenance releases:

Technical Details

Cisco attributes the flaw to insufficient error checking when processing HTTP requests to the Remote Access SSL VPN service. An attacker sends a crafted HTTP request; the error path mishandles the request and the device reloads.

On the CWE-244 classification: CWE-244 is "Improper Clearing of Heap Memory Before Release," also called Heap Inspection — and CISA's KEV title inherits Cisco's assignment of it. It is an awkward fit. CWE-244 normally describes sensitive data left behind in freed heap memory, an information-disclosure weakness, whereas the documented impact here is purely availability. The reasonable reading is that mishandled heap memory on an error path during HTTP request processing produces a crash rather than a leak. No public technical analysis of the underlying memory-handling bug has been published, so nothing more specific than Cisco's own "insufficient error checking" wording should be assumed.

Attack characteristics:

• Authentication required: none — unauthenticated and remote.
• Attack complexity: low. No user interaction.
• Single request vs. chained: a single crafted HTTP request is sufficient to force a reload. No chaining with other CVEs has been reported.
• Impact ceiling: availability only.

Discovery

The Cisco advisory gives dual credit:

• Cisco internal security testing
• Valerio Brussani (@val_brux, harmonyguard.cloud), reporting independently

Cisco PSIRT separately became aware of active exploitation in the field during August 2026.

Exploitation Context

• Confirmed active exploitation. Cisco's advisory states that PSIRT became aware of active exploitation in August 2026, prior to the 2026-08-11 advisory publication.
• Three-day KEV deadline (added 08-11, due 08-14) — among the most aggressive windows CISA issues, reflecting an internet-facing appliance under live attack with no workaround available.
• Threat actor attribution: none published. Cisco has released no detail on who is exploiting the flaw or which sectors are targeted, and no third party has attributed the activity.
• Exposure counts: no Shodan, Censys, or Shadowserver figure specific to this CVE has been published.
• Chaining: none reported.

Remediation

1. Upgrade to a fixed release. There are no workarounds — Cisco explicitly states that none exist and that upgrading is the only remediation.
2. Triage before you patch. Check show running-config for crypto ikev2 enable, webvpn enable, or zero-trust enable. Devices with none of these are unaffected, which may sharply reduce the number of appliances needing an emergency change window.
3. Verify the target build in the Cisco Software Checker for your exact platform and train. Several fixes ship as hotfixes rather than standard maintenance releases, and the 9.16 / 9.18 ASA builds in particular should be confirmed at source.
4. Interim risk reduction if a hotfix cannot be deployed immediately — restrict which source networks can reach the RA VPN service via ACL or upstream filtering. This is imperfect and is not a vendor-endorsed workaround: the service must stay reachable by remote users to remain useful.
5. Review logs for exploitation. Cisco has published no IoCs, so hunt the symptom rather than the signature: unexplained device reloads. Review show crashinfo, traceback entries in syslog, and reload-reason history, and correlate unexpected reloads with bursts of inbound HTTP to the WebVPN or RA VPN interface. Repeated unexplained reloads of an RA VPN-enabled ASA or FTD during August 2026 should be treated as probable exploitation.