Cisco's firewalls have a new bug, and this time attackers don't need to steal a single credential to cause damage. CVE-2026-20349 lets anyone who can reach the VPN login page on a Cisco Secure Firewall ASA or FTD device send one crafted HTTP request and force the box to reload — no username, no password, no prior foothold. Cisco's own Product Security Incident Response Team confirmed active exploitation in the wild this month, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 11, giving federal civilian agencies until August 14 to patch it.
What actually happens when someone hits this
The bug sits in how ASA and FTD process incoming HTTP requests to the Remote Access SSL VPN service — the same web-facing login page remote employees hit every morning. Cisco's advisory describes it as insufficient error checking: a specially crafted request can leave heap memory improperly cleared, and the device reloads to recover. That's it. No shell, no persistence, no data leaves the box. What you get is a hard reboot on demand, which for a VPN gateway means every remote worker, every site-to-site tunnel, and every piece of traffic routed through that appliance drops at once — and comes back only once the device finishes booting. Do that on a loop and you've got a denial-of-service weapon that doesn't require malware, credentials, or even much skill. Cisco's advisory lists no workaround — patching is the only fix.
What's affected
Secure Firewall ASA
Vulnerable versions
9.16, 9.18, 9.20, 9.22, 9.23, 9.24
Fix status
Patched — upgrade now
Secure Firewall Threat Defense (FTD)
Vulnerable versions
7.0, 7.2, 7.4, 7.6, 7.7, 10.0
Fix status
Patched — upgrade now
Vulnerable versions
Fix status
Secure Firewall ASA
9.16, 9.18, 9.20, 9.22, 9.23, 9.24
Patched — upgrade now
Secure Firewall Threat Defense (FTD)
7.0, 7.2, 7.4, 7.6, 7.7, 10.0
Patched — upgrade now
Cisco firewalls keep ending up in this position
This isn't Cisco's first rodeo with ASA and FTD under active attack — the company's own Talos team has spent the last two years chasing state-linked campaigns that specifically hunt these boxes, because a firewall sitting at the network edge is the single most valuable foothold an attacker can get. A denial-of-service bug is a different threat model than the remote-code-execution flaws that made headlines in those campaigns, and it's not the first management surface on Cisco's own hardware to get hit this year — a root-access proof-of-concept surfaced for Cisco's IMC too. Knock a VPN gateway offline during a ransomware response, a failover event, or just a bad Monday, and you've bought the attacker exactly the chaos window they wanted, without needing to breach anything. BleepingComputer's writeup notes Cisco hasn't said whether this is opportunistic scanning or a targeted campaign, which tells you they probably don't know yet either.
Cisco ASA and FTD appliances sit at the network edge, which is exactly why a denial-of-service bug in one is more disruptive than it sounds. · Unsplash
What to actually do this week
Identify every ASA and FTD device you run and check its exact software version against Cisco's advisory.
2
Apply the fixed release Cisco published for your version — there's no workaround, only the upgrade.
3
If you can't patch immediately, restrict access to the SSL VPN web interface to trusted IP ranges only.
4
Check device logs for unexpected reloads around the VPN service — that's the tell this has already been tried against you.
How fast this moved
August 2026
Cisco PSIRT confirms active exploitation of CVE-2026-20349 against ASA and FTD devices.
August 11, 2026
CISA adds the flaw to its Known Exploited Vulnerabilities catalog.
August 14, 2026
Deadline for U.S. federal civilian agencies to patch, under Binding Operational Directive 26-04.
This is the same pattern this site keeps tracking across enterprise network gear this year — an unauthenticated bug in edge infrastructure, exploited within weeks of disclosure, landing on CISA's list with a short federal clock attached. It follows VMware's vCenter reverse-SSH bug, Citrix's NetScaler SAML flaw, and an unauthenticated GeoServer SQL injection that all moved from disclosure to active exploitation faster than most IT teams' patch cycles.
Quick answers
Can CVE-2026-20349 be used to steal data?
No. It's a denial-of-service bug — the device reloads, it doesn't hand over data or a shell. The risk is availability, not confidentiality.
Is there a workaround if I can't patch right away?
Cisco says no — there's no mitigation listed in the advisory. Restricting access to the VPN web interface reduces exposure but doesn't close the hole.
Do I need to worry if I run FTD but not ASA?
Yes. FTD versions 7.0 through 10.0 are listed as vulnerable alongside ASA — check your exact build against Cisco's advisory.
How do I know if I've already been hit?
Look for unexplained reloads or crashes tied to the VPN service in your device logs around the dates attackers were active. Cisco hasn't published exact indicators of compromise.
Cisco fixed this quietly and without much fanfare, which is probably why it hasn't gotten the attention a CVSS 8.6-and-actively-exploited bug usually earns. That's a mistake. If your ASA or FTD box is the only door your remote workforce walks through, a bug that reliably slams it shut is worth patching before your next status meeting, not after.
