# Cisco Secure Firewall ASA/FTD Zero-Day (CVE-2026-20349) Exploited for DoS via Crafted HTTP Requests to Remote Access SSL VPN

> Cisco patched CVE-2026-20349, an unauthenticated, remotely exploitable denial-of-service flaw in the Remote Access SSL VPN service of Secure Firewall ASA and FTD software, after confirming active exploitation. CISA added the CVSS 8.6 flaw to its Known Exploited Vulnerabilities catalog on 2026-08-11 with a federal patch deadline of 2026-08-14; Cisco has released hotfixes for all affected releases but no workaround exists.

- **Published:** 2026-08-12T00:00:00Z
- **Last reviewed:** 2026-10-14T07:48:54.118Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1993
- **ID:** TL-2026-1993
- **Severity:** HIGH (CVSS 8.6)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 37 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20349

## Description

On 2026-08-11 Cisco published Security Advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF disclosing CVE-2026-20349, a denial-of-service vulnerability affecting Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. The root cause is insufficient error checking while processing HTTP requests to the Remote Access SSL VPN (webvpn) service: a remote, unauthenticated attacker can send a specially crafted HTTP request that forces the device to reload unexpectedly, producing a denial-of-service condition. The flaw is tracked under CWE-244 (Improper Clearing of Heap Memory Before Release / Heap Inspection) and carries a CVSS 3.1 base score of 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) — network-exploitable, low complexity, no privileges or user interaction required, scope changed, availability impact high, no confidentiality/integrity impact. Cisco's advisory does not disclose the precise parsing/heap-handling defect that triggers the crash, nor the exact structure of the crafted request.

A device is vulnerable only when one of several remote-access features creates an SSL listening socket: IKEv2 Remote Access VPN with client services (`crypto ikev2 enable <interface> client-services port <port>`), SSL VPN/webvpn enabled on an interface (`webvpn` / `enable <interface>`), or Zero Trust Network Access on FTD (`zero-trust enable`). Cisco Secure Firewall Management Center (FMC) is not affected. The bug was found during Cisco's internal security testing and independently reported by external researcher Valerio Brussani.

Cisco's PSIRT confirmed it became aware of active in-the-wild exploitation of CVE-2026-20349 in August 2026 but has not disclosed the identity of the attacker(s), the scale of exploitation, or which organizations/sectors were targeted, and the advisory explicitly states it does not provide indicators of compromise associated with the ongoing exploitation. To help defenders detect exploitation attempts despite the absence of published attacker infrastructure IOCs, Cisco published two Snort detection rule signature IDs — SID 46897 and SID 59654 — for the vulnerable HTTP request pattern against the Remote Access SSL VPN service.

CISA added CVE-2026-20349 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-11 in the same batch as CVE-2026-68820 (Microsoft Windows Ancillary Function Driver for WinSock use-after-free) and CVE-2026-72898 (Metabase SQL injection), triggering a Binding Operational Directive 22-01 remediation deadline of 2026-08-14 for U.S. federal civilian executive branch agencies. Cisco has released hotfixes for every affected ASA (9.16, 9.18, 9.20, 9.22, 9.23, 9.24) and FTD (7.0, 7.2, 7.4, 7.6, 7.7, 10.0) release train; no workaround exists, so organizations that cannot immediately hotfix must accept risk or disable the vulnerable remote-access service. Given ASA/FTD's history as a repeatedly and actively targeted edge-VPN platform, defenders should treat any unexpected reload of an internet-facing ASA/FTD appliance with RA VPN, IKEv2, or ZTNA enabled as a potential CVE-2026-20349 exploitation event pending further Cisco guidance.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1592 Gather Victim Host Information
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1595.001 Active Scanning
- T1595.002 Active Scanning
- T1590.006 Gather Victim Network Information
- T1592.002 Gather Victim Host Information
- T1587.004 Develop Capabilities
- T1588.005 Obtain Capabilities
- T1588.006 Obtain Capabilities
- T1499 Endpoint Denial of Service
- T1499.004 Endpoint Denial of Service
- T1592.004 Gather Victim Host Information
- T1529 System Shutdown/Reboot

## Sources

- [Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Server Denial of Service Vulnerability (cisco-sa-asaftd-vpn-dos-dzv4mQFF)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF)
- [CISA Adds Three Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/08/11/cisa-adds-three-known-exploited-vulnerabilities-catalog)
- [CISA Known Exploited Vulnerabilities Catalog — CVE-2026-20349](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20349)
- [Cisco Patches Firewall Zero-Day Exploited for DoS Attacks](https://www.securityweek.com/cisco-patches-firewall-zero-day-exploited-for-dos-attacks/)
- [Cisco warns of ASA and FTD VPN flaw exploited to crash devices](https://www.bleepingcomputer.com/news/security/cisco-warns-of-asa-and-ftd-vpn-flaw-exploited-to-crash-devices/)
- [CVE-2026-20349 — Vulnerability-Lookup (CIRCL)](https://vulnerability.circl.lu/vuln/CVE-2026-20349)
- [NVD — CVE-2026-20349 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-20349)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1993