Cisco confirmed attackers are exploiting CVE-2026-20349 to crash ASA and FTD firewalls through the Remote Access SSL VPN. Who is exposed and how to patch.
Cisco is telling firewall administrators to patch immediately after confirming that attackers are already exploiting a flaw in some of its most widely deployed security appliances. The bug, tracked as CVE-2026-20349, lets an attacker who has never logged in knock a Cisco firewall offline by sending it a single malformed web request. Cisco disclosed the issue and its active exploitation in early August 2026, and by August 11 the U.S. Cybersecurity and Infrastructure Security Agency (CISA) had added it to its Known Exploited Vulnerabilities catalog.
The affected software runs the Remote Access SSL VPN that many organizations rely on to let staff connect from outside the office. That is exactly why a crash matters. Take the box down and remote workers lose their route into internal systems, so a denial-of-service bug here is closer to an outage than a nuisance.
CVE-2026-20349 carries a CVSS score of 8.6 out of 10. That is high but not critical, and the reason is that this is a denial-of-service bug rather than one that lets an attacker run code or read data. The cause is mundane: insufficient error checking while the firewall processes incoming HTTP requests.
An attacker who can reach the Remote Access SSL VPN service sends a crafted request, the device fails to handle it cleanly, and it reloads. No login, no user interaction, and no malware are involved. The reload clears the fault, but nothing stops the attacker from sending the same request again, holding the appliance in a reboot loop and the VPN effectively down for as long as the traffic keeps coming. Cisco says it found the flaw during its own internal security testing.
A device is only vulnerable if it is running one of the remote-access services that expose the affected web handler. Cisco names three configurations that put an appliance at risk: SSL VPN enabled, an IKEv2 Remote Access VPN with client services, or Zero Trust Network Access. Appliances used purely as internal firewalls, with none of those remote-access features switched on, are not affected.
The vulnerable releases span most of the supported line. On the ASA side that means versions 9.16, 9.18, 9.20, 9.22, 9.23 and 9.24. On Secure Firewall Threat Defense (FTD) it covers 7.0, 7.2, 7.4, 7.6, 7.7 and the newer 10.0 branch. These are the platforms enterprises put at the edge of their networks, so the exposed population is large and, by design, reachable from the public internet.
CISA's move set a hard clock for part of the market. Adding CVE-2026-20349 to the KEV catalog on August 11, 2026 obliged federal civilian agencies to patch or stop using affected devices by August 14, 2026. A three-day window is unusually tight, and it signals how seriously the government is treating the confirmed exploitation. Private companies are not bound by that deadline, but the KEV listing is widely used as a prioritization signal by security teams that are not.
Cisco has not said who is behind the attacks or which organizations have been hit, which is common in the first days of a campaign. These appliances have been a repeated target before. In 2025 a state-linked actor chained two zero-days in the same ASA and FTD platform, CVE-2025-20333 and CVE-2025-20362, seriously enough to prompt a CISA emergency directive. Cisco has not linked the current flaw to that earlier campaign.
There is no workaround. Cisco has released hot fixes for every affected ASA and FTD release, and upgrading is the only remediation. Administrators who cannot patch a public-facing appliance right away can reduce exposure by restricting which networks are allowed to reach the Remote Access SSL VPN service, but that narrows the attack surface rather than closing the hole.
The practical checklist, as of August 15, 2026, is short. Confirm whether SSL VPN, IKEv2 remote access, or ZTNA is enabled on any internet-facing ASA or FTD device. Check the running version against Cisco's advisory. Then schedule the hot fix, treating anything exposed to the internet as urgent. Expect internet-wide scanning for vulnerable gateways to continue while unpatched devices remain online, because for an attacker this is a cheap way to take a target's remote workforce offline.
Head to the original source for the full announcement and complete details.
Read Original Source