CVE-2026-20349

Think of your firewall’s SSL VPN like a building’s front door for remote access. This bug lets someone slam the door in a way that makes the firewall unexpectedly restart, which can stop VPN access until the system comes back up and stabilizes.

This matters if your business runs Cisco Secure Firewall Adaptive Security Appliance (ASA) software or Cisco Secure Firewall Threat Defense (FTD) software and you use the Remote Access SSL VPN service. It’s a remote denial-of-service risk that does not require login, so it becomes a concern when the SSL VPN endpoint can be reached from the internet. The risk applies when the vulnerable Remote Access SSL VPN service is reachable from the network an attacker can access (typically the public internet).

This should be treated as urgent because real-world exploitation is confirmed via CISA KEV listing. The public exploit exists, and the vulnerability can cause the device to reload, which means service disruption is a direct consequence once an attacker targets an exposed SSL VPN endpoint. Follow CISA guidance and apply mitigations or the vendor fix immediately.

1. Inventory and exposure check

   • Identify every Cisco Secure Firewall Adaptive Security Appliance (ASA) software and Cisco Secure Firewall Threat Defense (FTD) system you manage.
   • For each system, determine whether Remote Access SSL VPN is enabled and whether it is reachable from the internet (direct public access or via a publicly accessible network path).

2. Confirm whether you are affected

   • Open Cisco’s security advisory for CVE-2026-20349: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF
   • Compare your exact ASA/FTD software version(s) to the advisory’s affected/fixed version guidance.

3. Apply the vendor fix

   • Upgrade to the fixed version(s) specified in the Cisco advisory.
   • Plan for an appropriate maintenance window if the upgrade process requires rebooting or causes temporary VPN downtime.

4. If patching is delayed

   • Apply Cisco’s mitigations for this exact CVE from the same advisory.
   • Reduce exposure so the vulnerable Remote Access SSL VPN service is not broadly reachable from the internet—restrict source IP ranges, use network controls, and ensure only intended users can reach the endpoint.
   • If mitigations cannot be applied, CISA guidance indicates stakeholders should discontinue use of the product when mitigations are unavailable.

5. Validate and monitor

   • After updating/mitigating, test VPN connectivity and watch for unexpected reloads.
   • Review logs for repeated SSL VPN errors or system reload events tied to inbound HTTP requests during/after the change.

6. CISA timing

   • CISA KEV entry added 2026-08-11 with a remediation due date of 2026-08-14; treat your timeline as past-due if still unmitigated.

CVE-2026-20349 (CWE-244) is a remote denial-of-service in Cisco Secure Firewall ASA/FTD Remote Access SSL VPN. The mechanism is insufficient error checking while processing HTTP requests; a remote, unauthenticated attacker can send crafted HTTP requests that can cause the device to reload unexpectedly, producing a DoS condition. The issue is listed in CISA KEV (added 2026-08-11), which indicates confirmed exploitation in the field per CISA’s catalog criteria. A public exploit is available, increasing attacker practicality. The traffic-light verdict is RED, reflecting active risk due to real-world exploitation and the direct impact (device reload/service disruption). The remediation path is provided by Cisco in the security advisory referenced in the findings.