Cisco ASA and FTD DoS Vulnerability Exploited in the Wild (CVE-2026-20349)

CVE-2026-20349 is a vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software, caused by insufficient error checking when processing HTTP requests. An unauthenticated, remote attacker can trigger it by sending a crafted HTTP request to the SSL VPN service on an affected device. A successful exploit causes the device to reload unexpectedly, resulting in a denial-of-service condition; no credentials or user interaction are required, and confidentiality and integrity are not affected. Any organization running ASA or FTD software with the Remote Access SSL VPN service enabled is affected, especially devices whose VPN interface is reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-11 and is reported as exploited in the wild, though no public proof-of-concept is known.

Do: Upgrade ASA and FTD devices to the fixed releases listed in the Cisco PSIRT advisory for CVE-2026-20349. Until patching is complete, verify whether the Remote Access SSL VPN service is enabled and internet-exposed, restrict access to trusted sources where possible, and check logs for unexpected device reloads. Federal agencies must apply mitigations per CISA BOD 26-04 timelines.