Act nowKnown exploited

Advisory · CVE-2026-20349

One crafted request can knock Cisco firewalls offline

A heap-inspection flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD lets an unauthenticated attacker force the device to reload, causing a denial of service.

Advisory published August 11, 2026Independent summary
Vendor
Cisco
Product
Secure Firewall ASA and FTD
Identifier / CWE
CVE-2026-20349
CWE-244
Action timing
Sep 1, 2026
ELI5

Explain it like I’m five

The firewall's front door forgets to double-check odd-shaped knocks. One badly formed knock makes the whole guard collapse and reboot, leaving the gate unattended while it restarts.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted HTTP request

    An unauthenticated, remote attacker sends a crafted HTTP request to the Remote Access SSL VPN service.

  2. 02Weak error checking

    The service fails to handle the malformed request safely when processing it.

  3. 03Heap flaw triggers

    The heap-inspection vulnerability is exercised by the crafted request.

  4. 04Device reloads

    The device reloads unexpectedly, dropping VPN sessions and disrupting traffic.

What happened

On August 11, 2026, Cisco disclosed a denial-of-service vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software. CISA added it to the Known Exploited Vulnerabilities catalog the same day, and it carries a high CVSS 8.6 rating.

An unauthenticated, remote attacker can send a crafted HTTP request to the Remote Access SSL VPN service on an affected device. Insufficient error checking when the request is processed triggers the heap-inspection flaw, and a successful exploit forces the device to reload unexpectedly. The reload drops VPN sessions and interrupts traffic through the device until it recovers.

Cisco documents first fixed releases for each train in the advisory, including ASA 9.16.4.103, 9.18.4.94, 9.20.4.49, 9.22.3.26, 9.23.1.47, and 9.24.1.26, and FTD 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, and 10.1.0. Cisco notes that hardening releases covering this and other internally found vulnerabilities are now published and recommends upgrading to the appropriate one rather than relying on the earlier hot fixes.

What to do

  1. Identify ASA and FTD devices with the Remote Access SSL VPN service exposed to untrusted networks.
  2. Upgrade to the first fixed release on your software train, as listed in the Cisco advisory’s fixed-releases table (for example ASA 9.18.4.94 or 9.20.4.49, FTD 7.4.8 or 10.0.2).
  3. Prefer the hardening releases Cisco now recommends, since they include the fix plus additional internally discovered vulnerability fixes.
  4. While patching, limit who can reach the SSL VPN service so crafted requests cannot be delivered from untrusted sources.
  5. Monitor device and VPN logs for unexpected reloads or bursts of malformed HTTP requests against the SSL VPN service.
  6. Confirm the fixed release is running and that VPN services behave normally after the upgrade.

Management note

This is not data theft, it is a kill switch for remote access on the firewall itself, and it is being exploited in the wild. An attacker who can force your VPN concentrators to reload on demand can cut off remote workers and create cover for other activity. For a device class whose job is availability, patch it like an outage risk.