Cisco has confirmed that a high-severity vulnerability, identified as CVE-2026-20349, is actively being exploited to cause denial-of-service (DoS) conditions on its firewall products. The company's Product Security Incident Response Team (PSIRT) became aware of active exploitation in August 2026.
The vulnerability affects the Remote Access SSL VPN service within Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. Specifically, it impacts devices where IKEv2 Remote Access VPN (with client services), SSL VPN, or Zero Trust Network Access (ZTNA) features are enabled, meaning their SSL listen sockets are active.
Attackers can trigger the flaw by sending a specially crafted HTTP request to the vulnerable service. This request can cause the security appliances to unexpectedly reload, leading to a denial of service. Exploitation of CVE-2026-20349 does not require authentication or user interaction.
Cisco has released hot fixes to address the issue. For ASA software, patches are available for versions 9.16, 9.18, 9.20, 9.22, 9.23, and 9.24. For FTD software, fixes cover versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. The company has stated that no workarounds are available, and no specific indicators of compromise have been identified.
The vulnerability was initially discovered by Cisco during internal security testing. Separately, security researcher Valerio Brussani also reported the flaw.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-20349 to its Known Exploited Vulnerabilities catalog. US civilian federal agencies are mandated to remediate this vulnerability by August 14, 2026. Details regarding the nature and scope of the attacks are currently limited.
