CVE Tools
Track your stack

Cisco warns of ASA and FTD VPN flaw exploited to crash devices

BleepingComputerBy Lawrence Abrams

Reported exploitedCisco Secure Firewall ASACisco Secure Firewall Threat Defense (FTD)

Our summary

Cisco has released hot fixes for CVE-2026-20349, a high-severity denial-of-service vulnerability in Secure Firewall ASA and Threat Defense (FTD) software that is currently being actively exploited to crash devices. The flaw, which stems from insufficient error handling of HTTP requests, allows attackers to remotely trigger a device reload without authentication or user interaction when specific remote access services like SSL VPN are enabled. Affected products include ASA versions 9.16 through 9.24 and FTD releases 7.0 through 10.0, though Secure Firewall Management Center remains unaffected. Since there are no workarounds, administrators should immediately upgrade their systems to the patched releases provided by Cisco.

Read at BleepingComputer

BleepingComputer publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker NewsCisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0CVE-2026-20349
  2. The Hacker News⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and MoreCVE-2026-20349
  3. Help Net SecurityWeek in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-dayCVE-2026-20349
  4. Help Net SecurityCisco fixes vulnerability exploited to DoS its firewalls (CVE-2026-20349)CVE-2026-20349
  5. The Hacker NewsCisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoSCVE-2026-20349
  6. SecurityWeekCisco Patches Firewall Zero-Day Exploited for DoS AttacksCVE-2026-20349

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store