LIVE · cybersecurity feed
Live wire
ASOS Breach Reveals the Risks in Customer-Facing SaaSUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoAI Training Critical as Governance Challenges GrowUS Disrupts Chinese State-Sponsored Hacking ToolsCitrix warns admins to patch new NetScaler RCE flaw immediatelyCisco Patches a Dozen Critical VulnerabilitiesCisco warns of critical flaws allowing Nexus switch takeoverCVE-2026-21589 · Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Cyber experts call on CISA to create mandatory federal OT rulesGremlin Foresight AI finds system weaknesses and verifies the fixes
cve recordhighexploited in the wildzero day3 of 3 cataloguesexploit reported

CVE-2026-20349

Cisco · Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) · Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

Published · Added to CISA KEV
CVSS8.6
Severityhigh
WeaknessCWE-244
EPSS1.0%62.6th percentile
Exploited3 KEV sources
Ransomware useUnknown
Federal fix dueAug 14, 2026

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

patch window

Called exploited the same day it was disclosed.

Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.

The life of this vulnerability

  1. CVE published
  2. First KEV listingsame day
  3. Last sighting10d

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

Sources3 of 3
Listings differ by0 d
Strongest claimconfirmed

3 catalogues list it. CIRCL aggregates the others and is shown but not counted.

Public exploitation evidence

6 public reports collected from VulnCheck and CIRCL, first on Aug 11, 2026. Each links to its original source. We have not verified them.

Description

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.  This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

Required action (CISA)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

← Back to the CVE Tracker

Our coverage of CVE-2026-20349

CVE-2026-20349

U.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to address these flaws due to active exploitation. The vulnerabilities affect Metabase, Microsoft Windows, and Cisco Secure Firewall products.

CVE-2026-20349critical

U.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to address them promptly. The newly cataloged flaws include a critical SQL injection vulnerability in Metabase, a use-after-free flaw in Microsoft Windows' Ancillary Function Driver for WinSock, and a heap…

CVE-2026-20349high

Cisco fixes vulnerability exploited to DoS its firewalls (CVE-2026-20349)

Cisco has confirmed that a high-severity vulnerability, identified as CVE-2026-20349, is actively being exploited to cause denial-of-service (DoS) conditions on its firewall products. The company's Product Security Incident Response Team (PSIRT) became aware of active exploitation in August 2026.

CVE-2026-20349

Cisco Patches Firewall Zero-Day Exploited for DoS Attacks

Cisco has released patches for a zero-day vulnerability in its Secure Firewall ASA and FTD devices, which has reportedly been exploited in the wild to launch denial-of-service (DoS) attacks. The flaw, identified as CVE-2026-20349, allows for remote exploitation without requiring authentication, posing a significant risk to affected systems.