CVE-2026-20349: Cisco Secure Firewall ASA/FTD Remote Access VPN DoS (KEV)

Checked: 2026-10-29

CVE-2026-20349 is an insufficient-error-checking flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD Software that lets a remote, unauthenticated attacker send a single crafted HTTP request and force the device to reload, causing a denial-of-service condition; Cisco's PSIRT became aware of active exploitation in August 2026, and there is no workaround short of upgrading.

Vulnerability summary

Vulnerability ID	CVE-2026-20349
CVSS score	8.6
EPSS score	0.0101
CISA KEV	Yes — in the Known Exploited Vulnerabilities catalog
Source	NVD (Cisco PSIRT Secondary score only, not NVD Primary)
Published	2026-08-11T17:17:48.833

Affected components

Component	CPE	Version range
Cisco Secure Firewall ASA Software	cpe:2.3:o:cisco:adaptive_security_appliance_software::::::::	9.16.x through 9.24.x with Remote Access SSL VPN, IKEv2 Remote Access VPN with client services, or Zero Trust Network Access enabled; representative fixed releases include 9.16.4.103 and 9.22.3.26, per Cisco's per-train fixed-release table
Cisco Secure Firewall Threat Defense (FTD) Software	cpe:2.3:o:cisco:secure_firewall_threat_defense::::::::	7.0.x through 10.1.x with the same VPN services enabled; representative fixed releases include 7.6.6 and 10.1.0, per Cisco's per-train fixed-release table

What this means

CVE-2026-20349 is a heap-inspection / insufficient-error-checking vulnerability (CWE-244) in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. NVD's description states the flaw "is due to insufficient error checking when processing HTTP requests," and that "an attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device," causing the device to reload and resulting in a denial-of-service condition (NVD).

The CVE is rated by Cisco PSIRT (a CNA) at CVSS v3.1 8.6 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H — network-reachable, low attack complexity, no privileges or user interaction required, scope-changed, availability impact only. NVD's own vulnStatus for this record is "Analyzed," but NVD has not published an independent Primary CVSS metric of its own, so the 8.6 figure is Cisco's Secondary score, not NVD-confirmed (NVD).

Cisco's own advisory (cisco-sa-asaftd-vpn-dos-dzv4mQFF) confirms the vulnerability affects ASA Software releases 9.16 through 9.24 and FTD Software releases 7.0 through 10.1, but only on devices with Remote Access SSL VPN, IKEv2 Remote Access VPN with client services, or Zero Trust Network Access configured and enabled. Exploitation requires no authentication: an unauthenticated remote attacker sends a crafted HTTP request to the exposed service. The advisory lists per-train fixed releases — including ASA 9.16.4.103 and 9.22.3.26, and FTD 7.6.6 and 10.1.0, among others for each affected train — and states there is no workaround; Cisco PSIRT became aware of active exploitation of this vulnerability in August 2026 (Cisco Security Advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF).

CISA added CVE-2026-20349 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-11, with a required-action due date of 2026-08-14 under Binding Operational Directive 26-04, and lists known ransomware campaign use as "Unknown" (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed) (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.0101 (63.07th percentile) — modest for a confirmed KEV entry, consistent with a denial-of-service rather than code-execution primitive, though still worth prioritizing given the lack of a workaround (FIRST EPSS).

Any ASA or FTD device with SSL VPN, IKEv2 Remote Access VPN with client services, or ZTNA enabled should be upgraded to a fixed release from Cisco's per-train table immediately; because there is no workaround, exposure cannot otherwise be eliminated short of disabling the affected services.

How to fix this class of issueThis advisory does not name a weakness class we have a dedicated guide for yet. The fix is usually the vendor patch or firmware update referenced above — our guide below covers how to plan and verify that: NIST SP 800-40 Rev. 4: enterprise patch management planning, explained.

Evidence

Insufficient error checking when processing HTTP requests to the Remote Access SSL VPN service lets an unauthenticated remote attacker crash the device via a crafted HTTP request. — NVD
CVSS v3.1 score is 8.6 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, submitted by Cisco PSIRT as a Secondary score; NVD has not published its own Primary metric. — NVD
Affects ASA 9.16-9.24 and FTD 7.0-10.1 with Remote Access SSL VPN, IKEv2 RA VPN with client services, or ZTNA enabled; no workaround; representative fixed releases ASA 9.16.4.103/9.22.3.26, FTD 7.6.6/10.1.0; Cisco PSIRT became aware of active exploitation in August 2026. — Cisco Security Advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF
Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-11, due date 2026-08-14, known ransomware campaign use listed as Unknown; confirmed present in the live KEV feed by exact cveID match this run. — CISA KEV
EPSS score is 0.0101 (63.07th percentile) as of 2026-10-29. — FIRST EPSS

More advisories

CVE-2015-5287: Red Hat ABRT Coredump Symlink Privilege EscalationCVE-2015-5287: KEV symlink-attack privilege escalation in Red Hat's Automatic Bug Reporting Tool (ABRT) lets a local attacker gain root via a predictable coredump path. NVD-confirmed 7.8, sourced to NVD, CISA and Red Hat.CVE-2019-1068: Microsoft SQL Server RCE (KEV, re-added 2026)CVE-2019-1068: a 2019 Microsoft SQL Server remote code execution flaw CISA added to its KEV catalog in August 2026, seven years after patching, under its 2026 BOD 26-04 risk-based directive. Versions, scoring sourced to NVD and CISA KEV.CVE-2021-23758: Ajax.NET Professional (AjaxPro) Deserialization RCECVE-2021-23758: KEV deserialization-of-untrusted-data flaw in the end-of-life Ajax.NET Professional (AjaxPro) .NET library allows remote code execution. NVD-confirmed 9.8, sourced to NVD, CISA and the project's own fix commit.