CVE-2026-20349
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
Description
CVE-2026-20349 is a high-severity denial-of-service (DoS) vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. An unauthenticated, remote attacker can send a crafted HTTP request to the Remote Access SSL VPN service and cause the affected device to reload unexpectedly, resulting in a denial-of-service condition. The root cause is insufficient error checking when the device processes HTTP requests, and because no authentication or user interaction is required, the vulnerability is trivial to trigger against exposed ASA and FTD firewalls. With a CVSS score of 8.6 and inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, CVE-2026-20349 poses an urgent availability risk to organizations relying on these Cisco firewalls for remote-access VPN connectivity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | adaptive security appliance software | 9.16.1; 9.16.1.28; 9.16.2; 9.16.2.3; 9.16.2.7; 9.16.2.11; 9.16.2.13; 9.16.2.14; 9.16.3; 9.16.3.3; 9.16.3.14; 9.16.3.15; 9.16.3.19; 9.16.3.23; 9.16.4; 9.16.4.9; 9.16.4.14; 9.16.4.19; 9.16.4.27; 9.16.4.38; 9.16.4.39; 9.16.4.42; 9.16.4.48; 9.16.4.55; 9.16.4.57; 9.16.4.61; 9.16.4.62; 9.16.4.67; 9.16.4.70; 9.16.4.71; 9.16.4.76; 9.16.4.82; 9.16.4.84; 9.16.4.85; 9.16.4.89; 9.16.4.92; 9.18.1; 9.18.1.3; 9.18.2; 9.18.2.5; 9.18.2.7; 9.18.2.8; 9.18.3; 9.18.3.39; 9.18.3.46; 9.18.3.53; 9.18.3.55; 9.18.3.56; 9.18.4; 9.18.4.5; 9.18.4.8; 9.18.4.22; 9.18.4.24; 9.18.4.29; 9.18.4.34; 9.18.4.40; 9.18.4.47; 9.18.4.50; 9.18.4.52; 9.18.4.53; 9.18.4.57; 9.18.4.66; 9.18.4.67; 9.18.4.68; 9.18.4.71; 9.18.4.76; 9.18.4.82; 9.18.4.90; 9.18.4.135; 9.19.1; 9.19.1.5; 9.19.1.9; 9.19.1.12; 9.19.1.18; 9.19.1.22; 9.19.1.24; 9.19.1.27; 9.19.1.28; 9.19.1.31; 9.19.1.37; 9.19.1.38; 9.19.1.42; 9.20.1; 9.20.1.5; 9.20.2; 9.20.2.10; 9.20.2.21; 9.20.2.22; 9.20.3; 9.20.3.4; 9.20.3.7; 9.20.3.9; 9.20.3.10; 9.20.3.13; 9.20.3.16; 9.20.3.20; 9.20.4; 9.20.4.7; 9.20.4.10; 9.20.4.14; 9.20.4.19; 9.20.4.22; 9.20.4.28; 9.20.4.30; 9.20.4.34; 9.20.4.46; 9.22.1.1; 9.22.1.2; 9.22.1.3; 9.22.1.6; 9.22.2; 9.22.2.4; 9.22.2.9; 9.22.2.13; 9.22.2.14; 9.22.2.20; 9.22.2.32; 9.22.3; 9.22.3.5; 9.23.1; 9.23.1.3; 9.23.1.7; 9.23.1.13; 9.23.1.19; 9.23.1.22; 9.23.1.26; 9.23.1.32; 9.23.1.195; 9.24.1; 9.24.1.5; 9.24.1.9; 9.24.1.11; 9.24.1.155 |
| cisco | secure firewall threat defense | 7.0.0; 7.0.0.1; 7.0.1; 7.0.1.1; 7.0.2; 7.0.2.1; 7.0.3; 7.0.4; 7.0.5; 7.0.6; 7.0.6.1; 7.0.6.2; 7.0.6.3; 7.0.7; 7.0.8; 7.0.8.1; 7.0.9; 7.2.0; 7.2.0.1; 7.2.1; 7.2.2; 7.2.3; 7.2.4; 7.2.4.1; 7.2.5; 7.2.5.1; 7.2.5.2; 7.2.6; 7.2.7; 7.2.8; 7.2.8.1; 7.2.9; 7.2.10; 7.2.10.2; 7.2.11; 7.2.12; 7.3.0; 7.3.1; 7.3.1.1; 7.3.1.2; 7.4.0; 7.4.1; 7.4.1.1; 7.4.2; 7.4.2.1; 7.4.2.2; 7.4.2.3; 7.4.2.4; 7.4.3; 7.4.4; 7.4.7; 7.4.8; 7.6.0; 7.6.1; 7.6.2; 7.6.2.1; 7.6.4; 7.7.0; 7.7.10; 7.7.10.1; 7.7.11; 7.7.13; 10.0.0; 10.0.2 |
References
Weakness Type
CWE-244
CVE-2026-20349 is categorized under CWE-244. In this case the weakness manifests as insufficient error checking when the Remote Access SSL VPN service processes HTTP requests, which allows a crafted request to force the device into an unexpected reload and a denial-of-service state.
Learn more: CWE-244
Impact Analysis
CVE-2026-20349 is rated High with a CVSS score of 8.6. The attack vector is network-based, making the flaw remotely exploitable without physical access, and the attack complexity is low, so it can be triggered without special conditions. No privileges are required and no user interaction is needed, meaning an attacker can exploit an exposed device without authenticating or involving a victim. The scope is changed, indicating the impact can extend beyond the vulnerable component to the broader systems and users that depend on the firewall. The impact is limited to availability, which is high, while confidentiality and integrity are not affected: a successful exploit causes the ASA or FTD device to reload, dropping VPN sessions and interrupting network access until the device recovers, and repeated attacks can sustain the outage. With an EPSS score of roughly 0.9% (56th percentile) and confirmed KEV listing, the practical risk is significant for internet-facing remote-access VPN deployments.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-20349 by adding it to the Known Exploited Vulnerabilities catalog, so organizations should treat this DoS flaw as an in-the-wild threat and prioritize patching. The EPSS score of approximately 0.9% (56th percentile) indicates that widespread automated exploitation is not yet the norm, but the KEV listing demonstrates that attackers are already leveraging the vulnerability against Cisco ASA and FTD devices. No dedicated public exploit link is listed among the references beyond the Cisco vendor advisory, and the KEV ransomware flag is currently "Unknown." Given how easy it is to trigger an unauthenticated device reload, defenders should assume reliable exploitation techniques exist.
Remediation
- Apply Cisco's software update for the affected ASA/FTD release. Per CISA's KEV required action, apply mitigations in accordance with vendor instructions and BOD 26-04 guidance; if fixes are unavailable, discontinue use of the affected product.
- Consult the Cisco Security Advisory (cisco-sa-asaftd-vpn-dos-dzv4mQFF) to identify the fixed release for your specific ASA or FTD version and upgrade accordingly, as a very wide range of 9.16.x through 9.24.x ASA builds and 7.0.x through 10.0.x FTD builds are affected.
- Restrict exposure of the Remote Access SSL VPN service where possible, limiting reachability of the HTTPS/SSL VPN interface to expected client networks and using access controls to reduce the pool of hosts that can send requests to the service.
- Monitor devices for unexpected reloads and crash indicators, reviewing syslog and crash logs for signs of DoS exploitation attempts and setting up alerting on abnormal device reboots.
- Prepare failover and continuity measures, such as high-availability firewall pairs, so that a triggered reload does not translate into a prolonged remote-access outage.
Technical Details
CVE-2026-20349 arises from insufficient error checking in how the Remote Access SSL VPN service on Cisco ASA and FTD software processes HTTP requests. An attacker exploits this by sending a specially crafted HTTP request to the SSL VPN service, which the device fails to handle correctly and responds to by reloading unexpectedly. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H shows the attack is reachable over the network at low complexity, requires neither privileges nor user interaction, and has a changed scope with a high availability impact but no confidentiality or integrity impact — consistent with a pure denial-of-service condition rather than code execution or data disclosure. Because the reload disrupts the security appliance that mediates remote access for many downstream users, the changed scope reflects that the consequences reach beyond the firewall process itself.
Frequently Asked Questions
Is CVE-2026-20349 being actively exploited?
Yes. CVE-2026-20349 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. While its EPSS score is around 0.9%, the KEV listing means exposed Cisco ASA and FTD devices should be patched urgently.
What products are affected by CVE-2026-20349?
The vulnerability affects the Remote Access SSL VPN service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. A very broad range of releases is impacted, including ASA 9.16.x through 9.24.x builds and FTD 7.0.x through 10.0.x builds; consult the Cisco advisory for the exact fixed versions.
How do I fix CVE-2026-20349?
Apply Cisco's software update for your specific ASA or FTD release as described in Cisco Security Advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF, following CISA's KEV guidance under BOD 26-04. Where possible, restrict access to the SSL VPN service and monitor devices for unexpected reloads.
How severe is CVE-2026-20349?
It is rated High with a CVSS 3.1 score of 8.6. It is unauthenticated, network-exploitable, and requires no user interaction, with a changed scope and high availability impact; however, it does not affect confidentiality or integrity, as its consequence is a denial-of-service device reload rather than code execution.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.