Cisco ASA/FTD CVE-2026-20349: Exploited VPN Crash Bug

What to do

1. Check each ASA and FTD for webvpn, IKEv2 client-services or zero-trust in the running configuration.
2. Upgrade affected devices to the fixed release for their train, starting with internet-facing VPN headends.
3. Use Cisco's Software Checker to pick a release that also covers the other September 2026 Secure Firewall advisories.
4. Schedule the upgrade with failover in mind: on HA pairs, upgrade the standby first so VPN users see one controlled switchover instead of attacker-driven reloads.
5. Add monitoring for unexpected firewall reloads so a crash is noticed and investigated, not just rebooted through.

How to check if you are affected or compromised

• Look for unexplained reloads: check uptime with show version and look for crash data with show crashinfo.
• Correlate reload times with HTTPS requests to the VPN portal or IKEv2 client-services port in upstream logs.
• Check syslog and monitoring for VPN session drops across all users at the same moment, which suggests a device reload.

What happened#

On August 11, 2026, Cisco disclosed CVE-2026-20349, a denial-of-service flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Because of "insufficient error checking when processing HTTP requests," one crafted HTTP request from an unauthenticated attacker can make the device reload. Cisco says its PSIRT became aware of active exploitation in August 2026. CISA added the CVE to the Known Exploited Vulnerabilities catalog the same day, with an August 14 deadline for federal agencies. Its ransomware status is "Unknown".

The CVSS 3.1 score is 8.6 (High), with availability as the only impact. The CVE record classifies the bug as CWE-244 (heap inspection). Even so, Cisco describes only a reload, with no code execution or data exposure. Cisco found the bug in internal testing, and Valerio Brussani also reported it. Neither Cisco nor press coverage has named the attackers or their targets. Cisco published no indicators of compromise, BleepingComputer notes.

Who is affected#

A device is vulnerable if it runs an affected release and has at least one feature enabled that opens SSL listen sockets:

• IKEv2 remote access VPN with client services: crypto ikev2 enable <interface> client-services port <port>
• SSL VPN: webvpn then enable <interface>
• Zero Trust Network Access (FTD only): zero-trust enable

On FTD, remote access VPN is set up under Devices > VPN > Remote Access in FMC, or under Remote Access VPN in Firewall Device Manager. Secure Firewall Management Center itself is not affected. Cisco first shipped hot fixes. On September 16 it updated the advisory to point to its September 2026 hardening releases:

• ASA: 9.16.4.103 (9.16 and earlier), 9.18.4.94, 9.20.4.49, 9.22.3.26, 9.23.1.47, 9.24.1.26
• FTD: 7.0.10 (7.0 and earlier), 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, and 10.1.0

Hot fix build numbers in early coverage, such as the list in The Hacker News, predate this update. Use the advisory's current table.

Do you really need to act?#

Yes, if your firewall terminates remote access VPN. Those features exist so that users on the internet can connect, which means the vulnerable listener is reachable by design. Exploitation needs no login, and CISA's assessment marks it as automatable. The impact is real but bounded. A reload drops every VPN session and briefly interrupts traffic through the firewall. Repeated requests can keep a VPN headend down. Cisco describes no compromise of the device, which is why this rates patch-this-week rather than drop-everything.

Firewalls that only do site-to-site VPN or plain filtering, with none of the three features above enabled, are outside the vulnerable configuration. There is no workaround short of disabling the feature, which for most organizations means disabling remote access.

What to do now#

1. Check exposure on each device: show running-config webvpn, show running-config crypto ikev2 (look for client-services), and on FTD show running-config | include zero-trust. Note the release from show version.
2. Upgrade to the fixed release for your train, starting with internet-facing VPN headends.
3. Run your release through Cisco's Software Checker, linked from the advisory, to pick a build that also covers the other Secure Firewall advisories Cisco published on September 16.
4. On failover pairs, upgrade the standby unit first, then fail over, so users see one planned switchover.
5. Alert on unexpected reloads so that a crash gets investigated, not just rebooted through.

How to tell if you were hit#

Exploitation shows up as an outage, not as a foothold. Look for reloads nobody scheduled: compare uptime in show version against your change log, and check show crashinfo for crash data. Then match reload times to HTTPS requests against the VPN portal or the IKEv2 client-services port in upstream logs. Every VPN session dropping at the same moment is the typical signature. Cisco lists Snort rules 46897 and 59654 alongside the advisory. Because Cisco published no indicators of compromise, check for other activity in the same window if crashes coincide with suspicious logins or configuration changes.

Timeline#

• Aug 11, 2026 — Cisco publishes the advisory and hot fixes, citing active exploitation. CISA adds CVE-2026-20349 to KEV.
• Aug 14, 2026 — CISA's remediation deadline for federal agencies.
• Sep 16, 2026 — Cisco updates the advisory to version 1.1, replacing the hot fixes with September 2026 hardening releases.

Vulnerability records

• CVE-2026-20349 · KEV 2026-08-11 · A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Cisco — Cisco Secure Firewall ASA and FTD Software Remote Access SSL VPN Denial of Service Vulnerability (cisco-sa-asaftd-vpn-dos-dzv4mQFF) sec.cloudapps.cisco.com
2. CVE record — CVE-2026-20349 cve.org
3. NVD — CVE-2026-20349 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2026-20349 cisa.gov

Coverage and analysis

1. BleepingComputer — Cisco warns of ASA and FTD VPN flaw exploited to crash devices bleepingcomputer.com
2. The Hacker News — Cisco ASA and FTD flaw exploited (Aug 12, 2026) thehackernews.com