CVE-2026-20349: Cisco ASA Software DoS Vulnerability

CVE-2026-20349 Overview

CVE-2026-20349 is a denial of service (DoS) vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. An unauthenticated, remote attacker can trigger an unexpected device reload by sending a crafted HTTP request to the affected VPN service. The flaw is classified under CWE-244 and stems from insufficient error checking during HTTP request processing. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation against internet-facing Cisco firewalls.

Critical Impact
A single crafted HTTP request can force a Cisco ASA or FTD firewall to reload, disrupting remote access VPN services and network perimeter enforcement for all users behind the device.

Affected Products

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, versions 9.16.x through 9.24.x
Cisco Secure Firewall Threat Defense (FTD) Software, versions 7.0.x through 7.7.x and 10.0.x
Any ASA or FTD deployment with the Remote Access SSL VPN service enabled

Discovery Timeline

2026-08-11 - CVE-2026-20349 published to NVD
2026-08-12 - Last updated in NVD database
2026-08-13 - EPSS score recorded at 0.874% (55.75 percentile)

Technical Details for CVE-2026-20349

Vulnerability Analysis

The vulnerability resides in the HTTP request-handling logic of the Remote Access SSL VPN service exposed by Cisco ASA and FTD software. When the service parses a crafted HTTP request, missing error checks allow the request to reach code paths that were not designed to handle the malformed input. The resulting fault causes the device process to abort and the appliance to reload. Because the SSL VPN service is typically reachable from the internet, exploitation can be performed remotely without authentication or user interaction. The vulnerability is tracked under CWE-244: Improper Clean Up on Thrown Exception, reflecting inadequate exception handling in the affected code path.

Root Cause

The root cause is insufficient error checking during HTTP request processing within the Remote Access SSL VPN service. Malformed input that should be rejected early is instead passed to downstream logic, where it triggers an unrecoverable fault. The affected process handles perimeter traffic, so its failure propagates to a full device reload rather than a contained service restart.

Attack Vector

Exploitation requires only network reachability to the SSL VPN HTTPS endpoint. An attacker sends a crafted HTTP request to the VPN listener on the affected ASA or FTD device. No credentials, cookies, or session state are required. A successful request causes the device to reload, dropping all active VPN sessions and interrupting firewall traffic until the appliance completes boot. Repeated requests can produce a sustained outage. Cisco has documented this issue in the Cisco Security Advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF.

No public proof-of-concept code has been released. Refer to the Cisco Security Advisory for authoritative technical detail.

Detection Methods for CVE-2026-20349

Indicators of Compromise

Unexpected crashinfo or traceback files generated on the ASA or FTD device coinciding with inbound HTTPS traffic to the SSL VPN interface.
Unplanned device reloads recorded in show reload or FMC event logs without a corresponding administrative action.
Anomalous HTTP requests to the SSL VPN endpoint from unfamiliar source IP addresses, particularly requests with malformed headers or unusual URIs.

Detection Strategies

Monitor syslog for reload events such as %ASA-1-199018 and correlate them with inbound VPN traffic in the minutes preceding the crash.
Enable and review WebVPN and HTTP inspection logging to capture request-line and header anomalies against the SSL VPN listener.
Cross-reference source IP addresses of suspicious requests against CISA KEV threat intelligence and known scanner infrastructure.

Monitoring Recommendations

Alert on any unscheduled ASA or FTD reload and treat repeated reloads within a short window as a probable exploitation attempt.
Track SSL VPN process health metrics and HTTPS connection rates from external sources to detect abnormal request bursts.
Forward device syslog and NetFlow to a centralized analytics platform for correlation with perimeter traffic patterns.

How to Mitigate CVE-2026-20349

Immediate Actions Required

Apply the fixed software releases listed in the Cisco Security Advisory as the primary remediation.
Prioritize patching for any ASA or FTD appliance with the Remote Access SSL VPN service enabled and reachable from the internet.
Follow the CISA KEV catalog remediation deadlines, since the vulnerability is confirmed to be actively exploited.

Patch Information

Cisco has released fixed software for affected ASA and FTD versions. Consult the vendor advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF to identify the specific fixed release that maps to your currently deployed train (for example, 9.16.x, 9.18.x, 9.19.x, 9.20.x, 9.22.x, 9.23.x, 9.24.x for ASA; 7.0.x through 7.7.x and 10.0.x for FTD). No workaround fully eliminates the risk, so upgrading is the recommended path.

Workarounds

Restrict access to the Remote Access SSL VPN listener to known source networks using an upstream ACL or edge firewall where operationally feasible.
Disable the Remote Access SSL VPN service on devices that do not require it until patched software can be deployed.
Deploy high-availability pairs and ensure failover is tested so that a triggered reload on one unit does not cause a total outage.

bash

# Example: verify running ASA version and reload history before patching
show version | include Software
show reload
show crashinfo
# After upgrade, confirm the fixed release is active
show version | include Version