{"id":2799,"date":"2026-08-12T01:32:37","date_gmt":"2026-08-12T08:32:37","guid":{"rendered":"https:\/\/www.cycognito.com\/blog\/?p=2799"},"modified":"2026-08-12T01:34:52","modified_gmt":"2026-08-12T08:34:52","slug":"emerging-threat-cve-2026-20349-cisco-asa-and-ftd-denial-of-service-via-remote-access-ssl-vpn","status":"publish","type":"post","link":"https:\/\/www.cycognito.com\/blog\/emerging-threat-cve-2026-20349-cisco-asa-and-ftd-denial-of-service-via-remote-access-ssl-vpn\/","title":{"rendered":"Emerging Threat: (CVE-2026-20349) Cisco ASA and FTD Denial of Service via Remote Access SSL VPN"},"content":{"rendered":"\n
\"\"
Sample of assets impacted by the Cisco Remote Access vulnerability, identified by the CyCognito Platform<\/em><\/figcaption><\/figure>\n\n\n\n

What is CVE-2026-20349?<\/h2>\n\n\n\n

CVE-2026-20349 is a denial of service vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The flaw stems from insufficient error checking when the service processes HTTP requests.<\/p>\n\n\n\n

The vulnerability carries a CVSS v3.1 base score of 8.6 (High). Cisco tracks it under CWE-244.<\/p>\n\n\n\n

Exploitation requires no authentication and no user interaction. An attacker with network access to the Remote Access SSL VPN service can send a crafted HTTP request that causes the device to reload unexpectedly. Because the affected devices are firewalls and VPN concentrators, a successful exploit removes both the perimeter enforcement point and the remote access path for users at the same time.<\/p>\n\n\n\n

Cisco published the advisory on August 11, 2026, and stated that its Product Security Incident Response Team became aware of active exploitation in August 2026. CISA added CVE-2026-20349 to the Known Exploited Vulnerabilities catalog on the same day. There are no workarounds.<\/p>\n\n\n\n

What assets are affected by CVE-2026-20349?<\/h2>\n\n\n\n

A device is affected if it runs a vulnerable release of Cisco Secure Firewall ASA Software or Cisco Secure FTD Software and has a configuration that enables the SSL listen sockets. Cisco identifies three such configurations: SSL VPN, enabled through webvpn<\/code> with enable <interface_name><\/code>; IKEv2 remote access VPN with client services, enabled through crypto ikev2 enable <interface_name> client-services port <port_numbers><\/code>; and Zero Trust Network Access, enabled through zero-trust<\/code> with enable<\/code>, which is available only in Cisco Secure FTD Software. Cisco has confirmed that Secure Firewall Management Center Software is not affected.<\/p>\n\n\n\n

In practice, an affected asset is an internet-facing firewall or VPN head end. These devices sit at the network edge by design, terminate remote access sessions for employees and contractors, and answer HTTPS on a public address so that clients can reach them from anywhere. That same reachability is what makes the vulnerable service exposed to unauthenticated traffic.<\/p>\n\n\n\n

Remote access gateways are also among the hardest assets for a security team to patch quickly. They are frequently deployed in high availability pairs, they carry live user sessions, and taking one out of service interrupts remote work. Older appliances often remain in place long after a migration is nominally complete, still resolving, still listening, and still carrying an active VPN configuration that nobody owns.<\/p>\n\n\n\n

What does our data show about exposure patterns?<\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Exposure in this set is led by Industrials at 27.0% of observed assets, with Consumer Discretionary contributing 14.2% and Information Technology 12.7%.<\/p>\n\n\n\n

The concentration in Industrials is consistent with how these organizations operate. Manufacturing groups, logistics operators, and engineering and construction firms run geographically distributed sites, each of which historically justified its own remote access gateway. Consolidation programs tend to lag the physical footprint, and acquisitions add further appliances under configurations the acquiring security team did not choose. The result is a larger population of remote access endpoints per organization than the headcount alone would suggest, spread across regions with uneven patch windows.<\/p>\n\n\n\n

Across the full set, the pattern points less to any single sector than to a class of asset that resists routine maintenance. Remote access gateways are provisioned deliberately, are documented at the time of deployment, and then age in place. Exposure accumulates not because these devices are unknown but because the operational cost of touching them is high enough that a known device goes unpatched for months. That is a different failure mode from shadow IT, and it responds to a different remedy: continuous external validation of what is actually listening, rather than another round of asset discovery.<\/p>\n\n\n\n

Are fixes available?<\/h2>\n\n\n\n

Yes. Cisco has released hot fixes for both affected product families, available from the Cisco Software Center.<\/p>\n\n\n\n

For Cisco Secure Firewall ASA Software, hot fixes are published for releases 9.16 (89.16.4.50), 9.18 (89.18.4.50), 9.20 (9.20.4.235), 9.22 (9.22.3.191), 9.23 (9.23.1.211), and 9.24 (9.24.1.221). Cisco notes that hot fixes beginning with 89 require ASDM Release 7.24.1.374, because earlier ASDM releases do not recognize that ASA Software release numbering format. For Cisco Secure FTD Software, hot fix bundles are published for releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0, with separate packages per hardware platform.<\/p>\n\n\n\n

There are no workarounds. Cisco is explicit that upgrading to a fixed release is the only remediation, which means devices that cannot be taken out of service remain exposed until they are patched. Given confirmed exploitation in the wild, defenders should verify their specific release and platform against the Cisco Software Checker rather than assuming a given branch is covered.<\/p>\n\n\n\n

Are there any other recommended actions to take?<\/h2>\n\n\n\n

Alongside patching, defenders should:<\/p>\n\n\n\n