Cisco has issued a warning regarding a high-severity denial-of-service vulnerability, identified as CVE-2026-20349, which is actively being exploited to remotely crash affected devices. The flaw, with a CVSS score of 8.6, impacts devices running Cisco Secure Firewall Adaptive Security Appliance (ASA) or Secure Firewall Threat Defense (FTD) software when specific remote access services are enabled.
The vulnerability stems from insufficient error checking during the processing of HTTP requests. An attacker can exploit this by sending a specially crafted HTTP request to the Remote Access SSL VPN service on a vulnerable device. Successful exploitation leads to the device reloading, causing a denial-of-service condition.
Exploitation of CVE-2026-20349 can occur remotely without requiring authentication or user interaction, provided that SSL listen sockets are enabled. Configurations susceptible to this vulnerability include IKEv2 Remote Access VPN with client services, SSL VPN, and Zero Trust Network Access on FTD devices. Cisco's Secure Firewall Management Center (FMC) software is not affected.
Cisco became aware of active exploitation of this vulnerability in August 2026. However, the company has not disclosed details about the nature of these attacks, including the identities of the attackers or the specific organizations being targeted. No indicators of compromise associated with the ongoing exploitation have been provided.
The vulnerability was discovered through Cisco's internal security testing and was also independently reported by security researcher Valerio Brussani.
To address the issue, Cisco has released hot fixes for several affected software versions. These include ASA releases 9.16, 9.18, 9.20, 9.22, 9.23, and 9.24, as well as FTD releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. There are no known workarounds for the vulnerability, and Cisco strongly advises customers to upgrade to a fixed software release to fully mitigate the risk.
This disclosure follows another recent warning from Cisco this month concerning ClamAV vulnerabilities with public exploits affecting Secure Endpoint Connector for Windows, Mac, and Linux. Patches for those issues are anticipated later in August.
