Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF Security Impact Rating: High CVE: CVE-2026-20349
CSIRTS triage
- What
- Insufficient error checking in Remote Access SSL VPN service allows unauthenticated attackers to cause denial of service via crafted HTTP requests.
- Who is affected
- Organizations running Cisco Secure Firewall ASA and FTD software with Remote Access SSL VPN enabled.
- Urgency
- High urgency; the vulnerability is unauthenticated, remotely exploitable, and directly impacts device availability with no workarounds available.
- Action
- Apply Cisco security updates to Secure Firewall ASA and FTD software as released.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software
Get an email when a new Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software advisory drops — max one per day, one-click unsubscribe.
Details
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-20349Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 56% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-20349 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- highexploitedAL26-018 - Vulnerability affecting Cisco ASA and Secure Firewall Threat Defense Software Remote Access SSL VPN…cccs
- unknownexploitedNCSC-2026-0295 [1.00] [M/H] Vulnerability patched in Cisco Secure Firewall ASA and FTD softwarencsc-nl
- unknownexploitedCisco security advisory (AV26-807)cccs
- highexploited[NEW] [high] Cisco ASA (Adaptive Security Appliance) and Secure Firewall Threat Defense: Vulnerability enables…cert-bund
- unknownexploitedCisco Products Multiple Vulnerabilitieshkcert
- unknownexploitedVulnerability in Cisco products (August 12, 2026)cert-fr-avis
- highexploitedCVE-2026-20349: A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Securi…nvd
- highexploitedCISA Adds Three Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2026-20349: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FT…cisa-kev
More from Cisco Security Advisories
- unknownCisco Advance Notification for Publication of August 19, 2026, Security Advisories2026-08-14
- highClamAV Vulnerabilities Affecting Cisco Products: August 20262026-08-13
- highCisco Secure Firewall Management Center Software Static Credential Vulnerability2026-08-11
- mediumCisco Catalyst SD-WAN Manager Information Disclosure Vulnerability2026-08-07
- criticalCisco Advance Notification for Publication of August 5, 2026, Security Advisories2026-08-05