Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2026-20349 | 8.6 | 2.2% | ✅ listed | — | 74.61 (High) |
Cisco ASA/FTD VPN DoS Actively Exploited
CVE-2026-20349 is a High-severity denial-of-service vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. The flaw, rated CVSS 8.6, allows an unauthenticated remote attacker to send a crafted HTTP request that forces the device to reload unexpectedly, taking the VPN service offline.
Cisco PSIRT confirmed active exploitation in the wild in August 2026, with no public attribution to a specific threat actor, campaign, or target sector. CISA added the CVE to its Known Exploited Vulnerabilities catalog with a remediation deadline of August 14, 2026 for U.S. federal civilian agencies, underscing the urgency for perimeter-facing deployments.
How the Flaw Works
The root cause is insufficient error checking while the SSL VPN service processes incoming HTTP requests, which Cisco maps to CWE-244. An attacker sends a crafted HTTP request directly to the exposed SSL listen socket on the firewall. No credentials, admin interaction, or prior session are required.
A successful request triggers an unexpected reload of the device, resulting in a full denial-of-service on the affected ASA or FTD instance. The CVSS vector confirms the attack profile: remote network vector, low complexity, no privileges required, and availability impact.
Which ASA/FTD Configs Are Affected
A device is affected when it runs a vulnerable ASA or FTD release with at least one SSL listen socket configuration enabled. The primary config is IKEv2 Remote Access VPN with client services, enabled via crypto ikev2 enable <interface> on the relevant interface. Other SSL listen socket configurations listed in Cisco’s advisory are also in scope, but the IKEv2 client-services variant is the one most perimeter-facing deployments run.
Cisco ships hot fixes across six release trains: 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. Administrators must match the exact platform and release train to Cisco’s fixed software guidance before upgrading, since the hot fix package is specific to the FTD release and appliance model. There is no full workaround — the vendor states none exists that fully addresses the flaw, so affected devices must either install the hot fix or move to a fixed release.
Active Exploitation and Detection
Cisco PSIRT confirmed in-the-wild exploitation of CVE-2026-20349 in August 2026, with no public proof-of-concept released at disclosure. The vendor did not publish a standalone PoC script or exploit binary alongside the advisory, meaning defenders must rely on the observed traffic pattern or the provided Snort rules to confirm the attack on their own devices.
For detection, Cisco shipped two Snort rules: 46897 and 59654. These rules match the crafted HTTP request against the SSL listen socket and can flag the reload trigger in real time. They are not a patch replacement, though — Cisco explicitly states no workaround fully addresses the flaw, so the rules should be deployed alongside the hot fix or fixed release, not in place of it.
No vendor-published IOCs (file hashes, IP addresses, or domains) were released tied to the observed exploitation. This means defenders cannot match the activity against a known set of artifacts and should lean on behavioral monitoring, device-health telemetry, and HTTP request inspection to confirm the reload. The absence of IOCs also means the activity is not yet tied to a specific campaign or C2 infrastructure.
Attribution remains public-unconfirmed. Cisco did not name a threat actor, campaign, target sector, or geography. The activity could be cybercrime, espionage, hacktivism, or opportunistic scanning — the available reporting does not distinguish between them. Valerio Brussani independently identified and reported the same issue, but Cisco has not disclosed when either discovery originally occurred.
Key points
- CVE-2026-20349 is a High-severity DoS (CVSS 8.6) in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD software.
- An unauthenticated remote attacker sends a crafted HTTP request to the SSL VPN service to force an unexpected device reload, causing a denial-of-service.
- Cisco PSIRT confirmed active exploitation in August 2026; CISA added it to KEV with a remediation deadline of August 14, 2026.
- Affected configurations require IKEv2 Remote Access VPN with client services or a matching SSL listen socket; hot fixes span the 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 release trains.
- No public PoC or vendor-published IOCs are available; Cisco lists Snort rules 46897 and 59654 for detection.