Cisco has confirmed that a high-severity denial-of-service vulnerability in its Secure Firewall ASA and Firepower Threat Defense (FTD) software is being actively exploited in the wild. The flaw, CVE-2026-20349 (CVSS 8.6), allows an unauthenticated remote attacker to crash affected firewall devices by sending specially crafted HTTP requests to the SSL VPN service — no credentials or prior access required.
Cisco's Product Security Incident Response Team (PSIRT) confirmed active exploitation in its August 2026 advisory, making this a priority patch for organizations running Cisco firewall infrastructure.
Vulnerability Details
The flaw stems from insufficient error checking in how the ASA and FTD software processes HTTP requests directed at the Remote Access SSL VPN service. A malformed request triggers an unhandled error condition that forces the device to reload — effectively taking the firewall offline.
Affected Configurations
The vulnerability is exploitable when any of the following features are enabled:
- IKEv2 Remote Access VPN with client services
- SSL VPN (AnyConnect/Secure Client)
- Zero Trust Network Access (ZTNA) on FTD devices
If none of these features are enabled, the device is not vulnerable. However, in most enterprise deployments, at least one of these configurations is active.
Affected Versions
Cisco Secure Firewall ASA:
- 9.16.x
- 9.18.x
- 9.20.x
- 9.22.x
- 9.23.x
- 9.24.x
Cisco Firepower Threat Defense (FTD):
- 7.0.x
- 7.2.x
- 7.4.x
- 7.6.x
- 7.7.x
- 10.0.x
Not affected: Cisco Firepower Management Center (FMC) — the management console is not vulnerable.
Why This Is Serious
While a CVSS 8.6 denial-of-service vulnerability might seem less urgent than a code execution flaw, the operational context changes the calculus significantly:
-
Firewalls are critical network chokepoints — Taking down an ASA or FTD device disrupts VPN access for potentially thousands of remote workers, creates gaps in network segmentation, and may open the perimeter to other attacks during the downtime.
-
Active exploitation is confirmed — This is not a theoretical flaw. Cisco PSIRT has observed attackers actively exploiting it, indicating tooling exists and campaigns are underway.
-
No workaround exists — Cisco's advisory is explicit: there are no configuration changes that mitigate the vulnerability. The only fix is upgrading to a patched software release.
-
Unauthenticated attack vector — Any host with network access to the SSL VPN interface (typically internet-facing) can trigger the crash with no credentials.
Remediation
Patch
Upgrade to the patched software release corresponding to your ASA or FTD version. Cisco has released fixes for all affected versions. Consult the Cisco Security Advisory for the specific fixed release for your software track.
Operational Steps
- Identify exposed devices — Audit which ASA/FTD devices have SSL VPN, IKEv2 VPN, or ZTNA enabled and are internet-accessible.
- Prioritize internet-facing devices — These are directly exploitable without network pivoting.
- Stage patched images — Pre-download patched software before scheduling maintenance windows.
- Monitor for exploitation indicators — Check for unexpected device reloads or
%ASA-1-505014style reload reason logs. - Schedule emergency maintenance if internet-facing devices are running affected versions.
Interim Risk Reduction (Not a Fix)
While there is no configuration workaround, organizations can reduce exposure by:
- Implementing ACLs or firewall rules to restrict who can reach the SSL VPN interface from the internet (e.g., limit to known IP ranges if feasible)
- Enabling rate limiting on the outside interface to slow down automated exploitation attempts
- Placing affected devices behind an upstream load balancer or ADC that can filter malformed HTTP requests
These measures reduce the attack surface but do not patch the vulnerability.
Context: Cisco ASA Vulnerabilities in 2026
This is not the first Cisco firewall flaw exploited in attacks this year. In March 2026, the Interlock ransomware group exploited a zero-day in Cisco Firepower Management Center (CVE-2026-20131) to achieve initial access. The pattern of ransomware operators and nation-state actors targeting Cisco firewall infrastructure reflects the high value of these devices as network entry points.
Organizations that have not audited their Cisco perimeter device patching cadence should use this advisory as an impetus to review their firewall software versions across the estate.