Cisco's firewall has a bug that lets anyone crash it — no password, no login, just one request

CVE-2026-20349 carries a CVSS score of 8.6 and hits the Remote Access SSL VPN service on Cisco Secure Firewall ASA (versions 9.16 through 9.24) and Secure Firewall Threat Defense (versions 7.0…

The flaw is an improper heap-memory clearing bug (CWE-244) triggered by a single malformed HTTP request — no login, no user interaction, no malware needed.

Cisco's PSIRT confirmed active exploitation in August 2026 but hasn't disclosed who's behind it or how many devices were hit.

CISA added it to the Known Exploited Vulnerabilities catalog on August 11 and gave federal agencies a three-day window, until August 14, to patch.

Cisco has shipped fixed software for every affected release — there's no workaround, only the upgrade.

My honest take

Everyone's trained to panic about the RCE headlines and shrug at 'just a reboot.' I think that's backwards for this one. An RCE needs skill and gets patched fast because it's scary. A one-request…