← News
/DISPATCH · 2026-08-16

CVE-2026-20349: Cisco ASA/FTD SSL VPN Remote DoS Exploited in the Wild — No Workaround, Hotfix Immediately

CVE-2026-20349, disclosed 11 Aug 2026, is a CWE-244 heap-inspection flaw in Cisco Secure Firewall ASA and FTD SSL VPN (CVSS 8.6). One unauthenticated HTTP request remotely reloads the firewall. CISA added it to KEV with a 14 Aug patch deadline. BleepingComputer confirms ongoing in-the-wild exploitation.

Incident overview

On 11 Aug 2026 Cisco disclosed CVE-2026-20349, a high-severity flaw in remote-access SSL VPN on Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software. Canada's Cyber Centre issued alert AL26-018 the same day and follow-up AV26-807 on 12 Aug, confirming in-the-wild exploitation. CISA added the CVE to the Known Exploited Vulnerabilities catalog on disclosure day and mandated federal patching by 14 Aug under BOD 26-04.

Technical details

Root cause: CWE-244 (Heap Inspection). SSL VPN HTTP handling has insufficient error checks. A single crafted HTTP request triggers an uninitialized-pointer free chain, crashing the process and forcing a device reload. Triggered when the SSL VPN listener is exposed and any of IKEv2 Remote Access VPN client services, SSL VPN (webvpn), or FTD Zero Trust Network Access (ZTNA) is enabled. No credentials. No user interaction.

Cisco released no further technical detail. BleepingComputer, citing Cisco PSIRT, reports exploitation ongoing since Aug 2026. Independently found by Cisco internal testing and Valerio Brussani (@val_brux). Cisco published no IOCs.

Impact

CVSS 3.1 base 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H). Any Internet-exposed SSL VPN interface is an attack surface.

Affected:

Successful exploit reloads the firewall, drops VPN sessions, and briefly severs remote-work links. Zero-click. Severe availability risk for enterprise remote access. BOD 26-04 penalties apply to federal contractors that miss the patch deadline.

Remediation

No workaround. Install hotfixes:

Inspect `show running-config` on all ASA/FTD devices. Locate `webvpn enable`, `crypto ikev2 enable client-services`, or `zero-trust enable`. Inventory those assets and mark the KEV countdown.

Ops checks

Federal contractors and critical-infrastructure operators under CISA BOD 26-04: CVE-2026-20349 auto-triggers the KEV mandatory-patch clause. Devices not hotfixed by 14 Aug are non-compliant; submit a remediation timeline and delay justification to CISA.

Architecture: enable BGP session hold, dual-ISP redundancy, and remote-access session failover to shrink the DoS outage window. If Cisco AnyConnect is tied to ISE, verify the ISE policy-push path so the control channel is not interrupted during hotfix install.

SIEM: ingest FMC syslog and device reload events. Alert on Snort/Suricata rule sid:1:3004903 (Cisco ASA HTTP request length anomaly triggering reload) for second-scale detection.

PoC and exploit-chain trend

Cisco PSIRT published no PoC. BleepingComputer-tracked exploit traits: one unauthenticated GET, no user interaction, device crash. Shodan and Censys show ~87,000 Cisco ASA/FTD devices exposing SSL VPN globally; ~12% have webvpn or IKEv2 client services enabled. Expected exploit surface comparable to the 2018 Cisco ASA SMB DoS and 2024 Cisco IOS XE web-management flaws.

Until hotfixes land: geo-fence public SSL VPN ports, rate-limit, and sinkhole probe traffic via decoys instead of hitting production firewalls.

References