NCSC-2026-0295 [1.00] [M/H] Vulnerability patched in Cisco Secure Firewall ASA and FTD software
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Cisco has patched a vulnerability in Cisco Secure Firewall ASA and FTD software. The vulnerability is located in the heap inspection within the Remote Access SSL VPN service. It arises from insufficient error checking during the processing of HTTP requests. An unauthenticated external attacker can send specially crafted HTTP requests to cause the affected devices to restart unexpectedly, resulting in a Denial-of-Service. The vulnerability affects network security appliances used for secure remote access.
CSIRTS triage
- What
- Insufficient error checking in HTTP request processing within the Remote Access SSL VPN service causes unexpected device restarts.
- Who is affected
- Organizations deploying Cisco Secure Firewall ASA and FTD appliances for remote access.
- Urgency
- High urgency due to active exploitation, denial-of-service impact, and unauthenticated attack vector.
- Action
- Apply Cisco security patches for Secure Firewall ASA and FTD as released in their August 19, 2026 advisory.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Secure Firewall ASA and FTD
Get an email when a new Secure Firewall ASA and FTD advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0295
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-20349Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 56% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-20349 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- highexploitedAL26-018 - Vulnerability affecting Cisco ASA and Secure Firewall Threat Defense Software Remote Access SSL VPN…cccs
- unknownexploitedCisco security advisory (AV26-807)cccs
- highexploited[NEW] [high] Cisco ASA (Adaptive Security Appliance) and Secure Firewall Threat Defense: Vulnerability enables…cert-bund
- unknownexploitedCisco Products Multiple Vulnerabilitieshkcert
- unknownexploitedVulnerability in Cisco products (August 12, 2026)cert-fr-avis
- highexploitedCVE-2026-20349: A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Securi…nvd
- highexploitedCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SS…cisco-psirt
- highexploitedCISA Adds Three Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2026-20349: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FT…cisa-kev
Recent advisories for Cisco Secure Firewall
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- highexploitedAL26-018 - Vulnerability affecting Cisco ASA and Secure Firewall Threat Defense Software Remote Access SSL VPN…cccs · 2026-08-13
- highexploited[NEW] [high] Cisco ASA (Adaptive Security Appliance) and Secure Firewall Threat Defense: Vulnerability enables…cert-bund · 2026-08-12
- highexploitedCisco Secure Firewall Management Center Software Static Credential Vulnerabilitycisco-psirt · 2026-08-11
- highexploitedCVE-2026-20349: A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Securi…nvd · 2026-08-11
- highexploitedCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SS…cisco-psirt · 2026-08-11
- criticalexploitedCVE-2026-20349: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FT…cisa-kev · 2026-08-11
More from NCSC-NL Advisories
- unknownNCSC-2026-0302 [1.00] [M/H] Vulnerabilities patched in SAP Commerce Cloud Data Hub Adapter2026-08-15
- unknownNCSC-2026-0301 [1.00] [M/H] Vulnerabilities patched in IBM i operating system by IBM2026-08-14
- unknownNCSC-2026-0300 [1.00] [M/H] Vulnerabilities patched in Fortinet FortiWeb2026-08-13
- unknownNCSC-2026-0299 [1.00] [M/H] Vulnerability patched in Fortinet FortiManager2026-08-13
- unknownNCSC-2026-0298 [1.00] [M/H] Vulnerabilities patched in Autodesk AutoCAD2026-08-13