Full research report
Cisco warns of ASA and FTD VPN flaw exploited to crash devices
Executive assessment
CVE-2026-20349 is a high-severity, unauthenticated denial-of-service vulnerability in exposed Cisco ASA and FTD remote-access services, not the Unified Communications Manager vulnerability CVE-2026-20230. Cisco and CISA both confirm exploitation, but the public evidence describes only forced device reloads and does not identify actors, victims or a broader campaign. Exposure depends on vulnerable software plus an enabled SSL listening configuration associated with IKEv2 client services, SSL VPN or FTD Zero Trust Network Access. Cisco has supplied hot fixes across the affected ASA and FTD release trains and explicitly states that no workaround addresses the flaw. The absence of a verified public repository means proof-of-concept availability remains unconfirmed rather than disproved.
What happened
Cisco published CVE-2026-20349 on 11 August 2026 after its Product Security Incident Response Team became aware of active exploitation during August. Unauthenticated remote requests to exposed Remote Access SSL VPN services can force affected Cisco Secure Firewall ASA or FTD devices to reload, causing denial of service. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on the same day and set 14 August 2026 as the remediation deadline for covered organisations.
Affected scope
Vulnerable releases of Cisco Secure Firewall ASA and Secure FTD are affected when SSL listen sockets are enabled through IKEv2 Remote Access VPN with client services, SSL VPN, or—on FTD only—Zero Trust Network Access. Cisco issued hot fixes for ASA release trains 9.16, 9.18, 9.20, 9.22, 9.23 and 9.24 and FTD trains 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0. Cisco Secure Firewall Management Center software is not affected.
Technical assessment
Cisco attributes the weakness to insufficient error checking while the Remote Access SSL VPN service processes HTTP requests. A malformed request reaching an enabled SSL listening service can cause an unexpected device reload; no authentication or user interaction is required, making exposed VPN interfaces operationally significant targets. The demonstrated impact is availability loss rather than confidentiality or integrity compromise. CISA labels the weakness as heap inspection/CWE-244, while Cisco's more detailed primary advisory describes request-processing error handling; Cisco's description is the stronger account of the trigger and consequence.
Recommended defensive actions
- Apply the Cisco hot fix or upgrade to a fixed release for every affected ASA and FTD device as the highest priority because no workaround is available.
- Inventory ASA and FTD devices and verify whether IKEv2 client services, SSL VPN or FTD Zero Trust Network Access enables an SSL listening socket.
- Restrict remote-access service exposure to authorised source networks where operationally feasible while patching is completed.
- Monitor for unexpected firewall reloads, availability interruptions and unusual inbound HTTP activity immediately preceding a reload.
- Review device and upstream network telemetry for repeated requests to remote-access interfaces and investigate correlated outages.
- Validate patched devices with Cisco Software Checker and test remote-access availability after the change.
Uncertainties and evidence gaps
- Cisco has not identified the actors, targeted organisations, sectors, attack volume or geographic scope of the exploitation.
- No indicators of compromise or request-level detection signature specific to the observed exploitation were published in the reviewed evidence.
- No verified public proof-of-concept or standalone exploit repository was found; active exploitation does not itself establish public exploit-code availability.
- CISA's CWE-244 heap-inspection label is not fully reconciled with Cisco's description of insufficient HTTP-request error checking.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Confirmed active exploitation in August 2026; no verified public proof-of-concept or exploit repository was found.
The investigation separated CVE-2026-20349, the ASA/FTD VPN denial-of-service event, from the unrelated CVE-2026-20230 Unified Communications Manager vulnerability mentioned in the source records. Cisco's advisory established the affected configurations, mechanism, active-exploitation statement and fixes, while CISA, NVD and the CVE Program independently confirmed the vulnerability and exploitation status. Searches for public exploit material did not identify a verified repository, and no actor or victim attribution was available.
- Could the supplied news report be verified directly?Opened the supplied BleepingComputer URL.bleepingcomputer.com ↗
The site presented an automated security challenge, so its reporting could not be independently verified from the live page.
why The article was not treated as proof, and subsequent conclusions relied on accessible primary and corroborating records.
- What vulnerability and impact are independently recorded?Reviewed the NVD entry for CVE-2026-20349.nvd.nist.gov ↗
NVD records an unauthenticated remote flaw in the ASA/FTD Remote Access SSL VPN service that can reload a device and cause denial of service; it carries a Cisco CVSS 3.1 score of 8.6 and is marked as present in CISA KEV.
why This corroborated the product, access requirements and availability impact without relying on the news report.
- Does the vendor confirm the event and provide remediation?Opened and examined Cisco's security advisory.sec.cloudapps.cisco.com ↗
Cisco confirms active exploitation in August 2026, identifies insufficient HTTP-request error checking, lists vulnerable remote-access configurations, provides ASA and FTD hot fixes, and states that no workaround exists.
why As the primary technical source, this established the exploitation assessment, affected scope and required remediation.
- Has a government authority independently classified the flaw as exploited?Reviewed the filtered CISA Known Exploited Vulnerabilities catalogue entry.cisa.gov ↗
CISA lists CVE-2026-20349 as known exploited, added it on 11 August 2026 and assigned a 14 August 2026 remediation deadline.
why This independently substantiated exploitation in the wild and elevated patching urgency.
- Is the CVE assignment and technical description authoritative?Reviewed the CVE Program record.cve.org ↗
The Cisco-assigned record confirms the affected ASA/FTD Remote Access SSL VPN service, unauthenticated remote access, request-processing weakness and denial-of-service outcome.
why This confirmed that CVE-2026-20349 is the correct identifier; CVE-2026-20230 concerns a separate Cisco Unified Communications Manager story.
- Is public proof-of-concept material readily available?Searched GitHub repositories for the exact CVE identifier.github.com ↗
GitHub returned no matching repositories at the time of review.
why This supports only the limited conclusion that no verified public repository was found, not that exploit code cannot exist privately or elsewhere.
- Does independent security-industry material corroborate the core facts?Reviewed Tenable's CVE summary.tenable.com ↗
Tenable repeats the unauthenticated Remote Access SSL VPN denial-of-service description and identifies the vulnerability as a KEV entry.
why This provided additional independent corroboration but no new actor attribution, indicators or exploit details.
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (2 primary, 2 corroborating, 1 contextual and 0 PoC/exploit references). 56 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| BleepingComputernews | ok15 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA KEVkev | ok1665 records | Primary evidence3 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. Supplied a vendor or government advisory opened and verified during focused research. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| NVDcve | ok900 records | Corroborating1 matched items | Supplied independent analysis opened and verified during focused research. |
| FIRST EPSSepss | ok | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5323 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok680 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1008 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok14 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1590 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| The Hacker Newsnews | ok15 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 13 opened outside the registered collection
Vulnerability & exploitation3
Vendor & gov advisories2
Cisco confirms active exploitation, affected configurations, hot fixes and the absence of a workaround.
CISA added the vulnerability on 11 August 2026 with a remediation due date of 14 August 2026.
Analysis & research3
Independently records the unauthenticated remote denial-of-service condition, CVSS 8.6 rating and KEV status.
Confirms Cisco as the assigning authority and identifies insufficient HTTP-request error checking as the cause.
Corroborates the affected service, denial-of-service impact and KEV designation.