Exploitation of Cisco ASA and FTD VPN vulnerability CVE-2026-20349

Cisco has confirmed active exploitation of vulnerability CVE-2026-20349 (CVSS 8.6) in Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) products. The vulnerability allows an unauthenticated remote attacker to force a device reboot — and, as a result, a denial of service — by sending a specially crafted HTTP request to the Remote Access SSL VPN service. There are no workarounds; the only mitigation is to install updates. CISA has added the vulnerability to the Known Exploited Vulnerabilities catalog, requiring U.S. federal agencies to remediate it by August 14, 2026.

Technical essence of the vulnerability

The root cause is insufficient error handling when processing HTTP requests in the VPN components. According to the official Cisco advisory, the attacker sends a specially crafted HTTP request to the Remote Access SSL VPN service on a vulnerable device. Successful exploitation causes the device to reload, which means a complete loss of network connectivity for the duration of the reboot.

Critically, no authentication is required for exploitation. The attack is carried out remotely over the network, which, combined with the CVSS 8.6 score, places this vulnerability in the high severity category. A device is vulnerable if at least one of the following configurations is enabled:

• IKEv2 Remote Access VPN with client services — configuration crypto ikev2 enable <interface_name> client-services port <port_numbers>
• SSL VPN — configuration webvpn enable <interface_name>
• Zero Trust Network Access — configuration zero-trust enable

All three configurations are typical for organizations that provide remote access for employees, which makes the attack surface quite broad.

Impacted versions and fixes

Cisco ASA

• ASA 9.16 — fixed in 9.16.4.50
• ASA 9.18 — fixed in 9.18.4.50
• ASA 9.20 — fixed in 9.20.4.235
• ASA 9.22 — fixed in 9.22.3.191
• ASA 9.23 — fixed in 9.23.1.211
• ASA 9.24 — fixed in 9.24.1.221

Note: some publications contain typos in the ASA 9.16 and 9.18 version numbers. It is recommended to verify the exact fixed versions directly against the vendor advisory.

Cisco FTD

For FTD, fixes have been released as hotfixes for each hardware platform:

• FTD 7.0 — hotfixes version 7.0.9.1-1
• FTD 7.2 — hotfixes version 7.2.11.1-2
• FTD 7.4 — hotfixes version 7.4.7.1-1
• FTD 7.6 — hotfixes version 7.6.4.1-2
• FTD 7.7 — hotfixes version 7.7.11.1-2
• FTD 10.0 — hotfixes version 10.0.0.1-2

For each FTD train, there are separate hotfix files for the Firepower 1000, 2000, 3000, Secure Firewall TD 200, 1200, 4200 and 6100 platforms. The full list of files is available in the Cisco advisory.

Impact assessment

The scale of the affected infrastructure is potentially enormous. Cisco ASA and FTD are among the most widely used enterprise-grade firewalls in the world. SSL VPN and IKEv2 Remote Access VPN configurations are heavily used to provide remote access, especially in organizations with a hybrid work model.

Although the vulnerability is classified as a denial of service rather than remote code execution, its impact should not be underestimated. Rebooting a perimeter firewall means:

• Complete loss of network connectivity for all VPN users for the duration of the restart
• Possibility of repeated exploitation to maintain a prolonged denial of service
• Potential use of the DoS as a distraction for a parallel attack on other infrastructure components

Cisco reported that it detected active exploitation in early August 2026. The vulnerability was discovered during internal security testing; independently, it was also found and reported by researcher Valerio Brussani. At this time, no details have been disclosed about the attackers, their targets, or the effectiveness of the attacks.

Regulatory context

On August 11, 2026, CISA added CVE-2026-20349 to the Known Exploited Vulnerabilities catalog. This obliges all Federal Civilian Executive Branch (FCEB) agencies to apply fixes by August 14, 2026 — an extremely tight deadline of just three days. Such a short deadline underscores how serious CISA considers this threat to be.

For organizations outside the U.S. federal sector, the KEV catalog serves as an authoritative prioritization indicator: if a vulnerability is listed in KEV, it is being exploited by real attackers and demands immediate response.

Response recommendations

• Immediately determine exposure: check ASA and FTD configurations for the presence of the webvpn enable, crypto ikev2 enable ... client-services, or zero-trust enable commands. If at least one of them is active, the device is vulnerable.
• Install updates as a priority: Cisco has released fixes for all affected trains. There are no workarounds — patching is the only protection measure.
• Use platform-specific hotfixes for FTD: make sure you select the correct hotfix file for your hardware platform (FP1K, FP2K, FP3K, TD 200/1200/4200/6100).
• Monitor logs for unexpected reloads: sudden reloads of ASA/FTD devices, especially those correlating with incoming HTTP requests to VPN interfaces, may indicate exploitation attempts.
• Consider temporarily restricting access: until the patch is installed, if acceptable for business processes, restrict access to the VPN portal by IP addresses at the ACL level of upstream equipment.

Given the confirmed active exploitation, the lack of workarounds, and CISA’s three-day deadline, updating affected Cisco ASA and FTD devices should be the top priority for teams responsible for perimeter security. The full list of fixed versions and hotfix files is available in the Cisco security advisory; the entry in the NVD contains additional technical references.