A new vulnerability affecting Cisco Secure Firewall ASA and FTD software is currently being exploited in the wild, according to Cisco. The flaw allows unauthenticated attackers to trigger a denial-of-service condition on affected devices.
The vulnerability is tracked as CVE-2026-20349 and carries a CVSS score of 8.6. It is a case of insufficient error checking when processing HTTP requests.
I will explain the Cisco Secure Firewall DoS vulnerability and what needs to be known by administrators.
Key Points About the Vulnerability
- The flaw affects Cisco Secure Firewall ASA and FTD Software
- It is triggered by crafted HTTP requests to the Remote Access SSL VPN service
- A successful exploit causes the device to reload
- This results in a denial-of-service condition
- No authentication is required
- The vulnerability is being actively exploited
- No workarounds are available
Affected Configurations
The Cisco Secure Firewall DoS vulnerability affects devices running a vulnerable version of ASA or FTD Software. The device must also have one or more of these configurations enabled:
IKEv2 Remote Access VPN with client services
Command: crypto ikev2 enable <interface_name> client-services port <port_numbers>
SSL-VPN
Command: webvpn enable <interface_name>
Zero Trust Network Access
Command: zero-trust enable
Affected Versions
- ASA Versions:
- ASA 9.16: Fixed in 89.16.4.50
- ASA 9.18: Fixed in 89.18.4.50
- ASA 9.20: Fixed in 9.20.4.235
- ASA 9.22: Fixed in 9.22.3.191
- ASA 9.23: Fixed in 9.23.1.211
- ASA 9.24: Fixed in 9.24.1.221
FTD Versions:
- FTD 7.0: Hotfix GC-7.0.9.1-1
- FTD 7.2: Hotfix HM-7.2.11.1-2
- FTD 7.4: Hotfix HK-7.4.7.1-1
- FTD 7.6: Hotfix DD-7.6.4.1-2
- FTD 7.7: Hotfix AN-7.7.11.1-2
- FTD 10.0: Hotfix S-10.0.0.1-2
How the Exploit Works
The Cisco Secure Firewall DoS vulnerability is triggered by sending a crafted HTTP request to the Remote Access SSL VPN service. The device fails to properly error-check the request.
This causes the affected device to reload. The reload results in a denial-of-service condition. The attack requires no authentication.
Cisco became aware of active exploitation earlier this month. The issue was found during internal security testing.
What We Don't Know
Cisco has not disclosed specific details about the exploitation:
- The nature of the attacks
- The identity of the threat actors
- The origins of the attackers
- Which organizations have been targeted
- Whether any attacks were successful
CISA Response
The U.S. Cybersecurity and Infrastructure Security Agency has added the Cisco Secure Firewall DoS vulnerability to its Known Exploited Vulnerabilities catalog.
Federal Civilian Executive Branch agencies must apply the fixes by August 14, 2026. This deadline reflects the severity of the vulnerability and the active exploitation.
What Administrators Should Do
The Cisco Secure Firewall DoS vulnerability requires immediate action:
Immediate Steps:
- Check if you are running a vulnerable ASA or FTD version
- Verify if vulnerable configurations are enabled
- Apply the appropriate hotfix immediately
- No workarounds are available
Configuration Check:
- Review devices for IKEv2 Remote Access VPN with client services
- Check for SSL-VPN enabled interfaces
- Look for Zero Trust Network Access enabled
Hotfix Installation:
- ASA users should update to the fixed versions listed
- FTD users should apply the appropriate hotfix
- Hotfixes vary by platform and version
- Researcher Credit
Cisco credited Valerio Brussani for separately discovering and reporting the Cisco Secure Firewall DoS vulnerability. The issue was also found during Cisco's internal security testing.
Wrapping It Up
The DoS vulnerability present in Cisco Secure Firewall is rated as high and currently being exploited by attackers. The vulnerability causes device reload when unauthenticated users make HTTP requests on the SSL VPN service.
Key points to remember:
- Affects ASA and FTD Software
- Exploited through Remote Access SSL VPN
- Causes device reload
- No authentication required
- Active exploitation confirmed
- No workarounds available
- CISA has added it to the KEV catalog
Organizations should patch immediately. Check for vulnerable configurations. Apply the appropriate hotfix.
The Cisco Secure Firewall DoS vulnerability is a reminder that active exploitation can occur before patches are widely deployed. Patching on time is very important.
FAQ Section
What is the Cisco Secure Firewall DoS vulnerability?
CVE-2026-20349 is a denial-of-service vulnerability affecting Cisco Secure Firewall ASA and FTD Software. Unauthenticated attackers can trigger device reloads via crafted HTTP requests to the Remote Access SSL VPN service.
Which versions are affected?
ASA versions 9.16 through 9.24 and FTD versions 7.0 through 10.0 are affected. Fixed versions and hotfixes are available.
Is the vulnerability being exploited?
Yes. Cisco confirmed active exploitation earlier this month. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog.
What should administrators do?
Apply the appropriate hotfix or update immediately. No workarounds are available. Check if vulnerable configurations are enabled.
What configurations make a device vulnerable?
Devices with IKEv2 Remote Access VPN (with client services), SSL-VPN, or Zero Trust Network Access enabled are vulnerable.
