AL26-018 - Vulnerability affecting Cisco ASA and Secure Firewall Threat Defense Software Remote Access SSL VPN - CVE-2026-20349

Number: AL26-018 Date: August 13, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. Details The Canadian Centre for Cyber Security (Cyber Centre) is aware of active exploitation Footnote 1 of a high-severity vulnerability affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software Footnote 2 . Cisco disclosed this vulnerability on August 11, 2026, and has confirmed active exploitation in the wild. In response to the Cisco security advisory released on August 11, 2026, the Cyber Centre issued AV26-807 Footnote 3 on August 12, 2026. Tracked as CVE-2026-20349 Footnote 4 , this vulnerability is an Improper Clearing of Heap Memory Before Release ('Heap Inspection') (CWE-244) Footnote 5 vulnerability that may allow a remote attacker to cause a denial-of-service (DoS) condition. The vulnerability is caused by insufficient error checking when processing HTTP requests. An unauthenticated remote attacker could exploit the issue by sending a specially crafted HTTP request to an affected SSL VPN service. Successful exploitation could cause the firewall to reload unexpectedly, resulting in a denial of service (DoS) condition. Cisco Secure Firewall ASA and Secure Firewall Threat Defense SSL VPN Services that are accessible from the internet, particularly those with the vulnerable SSL VPN-Related services enabled, are at risk of being impacted. This vulnerability affects Cisco devices if they are running affected ASA or FTD software releases and have one or more of the following features enabled, which expose SSL listen sockets: