--- url: "https://xcademia.com/news/cisco-firewall-zero-day-cve-2026-20349-exploited-in-the-wild" title: "Cisco Firewall Zero-Day CVE-2026-20349 Exploited in the Wild" description: "Cisco confirms active exploitation of CVE-2026-20349, a high-severity firewall VPN flaw that can cause remote denial of service." publishedAt: "2026-08-13T07:01:34.985+00:00" updatedAt: "2026-08-13T07:28:47.482575+00:00" type: news category: cybersecurity source_name: "Cisco Security Advisory " source_url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF" tags: - "#Cisco" - "#Cybersecurity" - "#ZeroDay" - "#CVE202620349" - "#NetworkSecurity" - "#VPNSecurity" - "#FirewallSecurity" - "#Vulnerability" --- # Cisco Firewall Zero-Day CVE-2026-20349 Exploited in the Wild > Cisco has confirmed active exploitation of a high-severity vulnerability in its Secure Firewall ASA and FTD software that can let unauthenticated attackers remotely force affected devices to reload, causing denial of service. Source: **Cisco Security Advisory ** · 13 August 2026 ## Cisco Confirms Active Exploitation of Firewall Zero-Day Cisco is urging customers to patch affected firewall deployments after confirming **active exploitation of CVE-2026-20349**, a high-severity vulnerability affecting the Remote Access SSL VPN service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The vulnerability carries a **CVSS 3.1 base score of 8.6** and can be exploited remotely without authentication. A successful attack can cause an affected firewall to reload unexpectedly, resulting in a **denial-of-service (DoS)** condition. According to Cisco, the vulnerability is caused by **insufficient error checking when processing HTTP requests**. An attacker can exploit the flaw by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. Cisco's Product Security Incident Response Team (PSIRT) became aware of **active exploitation in August 2026**. Cisco has released software updates to address the vulnerability and strongly recommends customers upgrade to a fixed software release. ## What Is CVE-2026-20349? CVE-2026-20349 affects certain configurations of Cisco Secure Firewall ASA and FTD Software. The vulnerability affects the **Remote Access SSL VPN service**. Because exploitation does not require authentication, a remote attacker can attempt to trigger the vulnerability without first obtaining valid credentials. A successful exploit can cause the affected firewall appliance to **reload unexpectedly**, resulting in a denial-of-service condition. Cisco classifies the vulnerability as **High severity**, with a CVSS 3.1 score of **8.6**. The advisory identifies the weakness as **CWE-244**. ### How the attack works The attack path can be simplified as: **Unauthenticated Remote Attacker** ↓ **Crafted HTTP Request** ↓ **Remote Access SSL VPN Service** ↓ **Insufficient Error Checking** ↓ **Affected Cisco ASA or FTD Device** ↓ **Unexpected Reload** ↓ **Denial of Service** The key concern is that the attack does not require valid authentication. ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1786603761646-info-1--82-.webp) ## Why Active Exploitation Changes the Risk The vulnerability's **active exploitation status** makes CVE-2026-20349 more urgent than a routine vulnerability disclosure. A high-severity vulnerability already represents a significant security concern. When exploitation has been observed in the wild, organizations need to move more quickly from assessment toward remediation. The potential impact is also important. CVE-2026-20349 is described by Cisco as a **denial-of-service vulnerability**. An attacker does not necessarily need to obtain sensitive information or establish persistent access to cause operational disruption. If an affected firewall reloads unexpectedly, services relying on that device can be interrupted. For organizations using perimeter firewalls to support remote workers, external connectivity, or other network traffic, availability can be business-critical. ## Which Cisco Firewall Configurations Are Vulnerable? Not every Cisco Secure Firewall deployment is automatically vulnerable. According to Cisco, a device must be running a vulnerable ASA or FTD software release **and** have one or more potentially vulnerable configurations enabled. The relevant configurations include SSL VPN, IKEv2 Remote Access VPN with client services, and, for FTD Software, Zero Trust Network Access. **SSL VPN** SSL VPN deployments with WebVPN enabled on an interface can be affected. The relevant configuration is: ``` webvpn enable ``` **IKEv2 Remote Access VPN** Cisco also identifies IKEv2 Remote Access VPN configurations with client services enabled: ``` crypto ikev2 enable client-services port ``` **Zero Trust Network Access** For Cisco Secure FTD Software, **Zero Trust Network Access** can also create a potentially vulnerable configuration when enabled: ``` zero-trust enable ``` ## Cisco Secure Firewall Management Center Is Not Affected Cisco has confirmed that **Cisco Secure Firewall Management Center (FMC) Software is not affected** by CVE-2026-20349. Organizations managing ASA or FTD devices should still verify their software versions and configurations against Cisco's advisory. Cisco also provides a **Software Checker** that can help administrators identify security advisories affecting a particular software release and determine the earliest release that fixes the reported vulnerabilities. ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1786603783050-info-2--62-.webp) ## No Workaround Is Available One of the most important details in Cisco's advisory is that **there are no workarounds that address this vulnerability**. Cisco has instead released software updates and recommends customers upgrade to fixed software. This makes remediation particularly important for organizations operating affected Remote Access VPN services. With exploitation already confirmed, temporary network changes should not be treated as a substitute for installing the appropriate Cisco fix. ## Cisco Releases Hot Fixes for ASA and FTD Cisco has released hot fixes covering multiple ASA and FTD software branches. ### Cisco Secure Firewall ASA ASA Software Release Hot Fix 9.16 89.16.4.50 9.18 89.18.4.50 9.20 9.20.4.235 9.22 9.22.3.191 9.23 9.23.1.211 9.24 9.24.1.221 Cisco has also released corresponding FTD hot fixes for the **7.0, 7.2, 7.4, 7.6, 7.7, and 10.0** software lines across supported platforms. Administrators should consult Cisco's advisory and Software Center to identify the correct fix for their specific platform rather than selecting a release solely based on the branch number. For ASA hot fixes whose names begin with **89**, Cisco says **ASDM Release 7.24.1.374** should be installed because earlier ASDM releases do not recognize the new ASA software release numbering format. ## What Security Teams Should Do Now Because Cisco has confirmed active exploitation, organizations running potentially affected ASA or FTD deployments should prioritize remediation. **1. Identify affected devices** Create an inventory of Cisco Secure Firewall ASA and FTD devices and determine which software releases they are running. Pay particular attention to systems providing: - Remote Access SSL VPN - IKEv2 Remote Access VPN - FTD Zero Trust Network Access **2. Check vulnerable configurations** Review firewall configurations for WebVPN, IKEv2 client services, and, where applicable, Zero Trust Network Access. The presence of one of these configurations does not by itself establish that a device is vulnerable. The software release must also be checked against Cisco's affected and fixed release information. **3. Use Cisco's Software Checker** Cisco's Software Checker can help administrators determine whether a particular software release is affected and identify the earliest fixed release. This is especially useful in environments containing multiple firewall models and software versions. **4. Apply the appropriate fix** Cisco recommends upgrading to a fixed software release. Organizations should follow Cisco's platform-specific installation guidance and account for operational requirements before applying the update. **5. Validate after remediation** After patching, security and network teams should verify: - VPN availability - Firewall stability - Remote access connectivity - Unexpected reload activity - Relevant network and security telemetry Teams should also investigate suspicious activity where appropriate, particularly around exposed VPN services. ## Cisco's Patch Guidance Cisco has provided fixes for multiple ASA and FTD software branches. The company recommends upgrading to a fixed software release to fully remediate the vulnerability. The advisory also provides platform-specific hot fixes and directs customers to Cisco's Software Checker when they need to determine the appropriate release. This is particularly important for large environments where firewall models, software trains, and hardware platforms can vary across locations. Organizations should therefore avoid applying a generic version recommendation without checking the exact platform and software release. ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1786603818762-info-3--56-.webp) ## What the Vulnerability Means for VPN Security CVE-2026-20349 highlights the continuing security challenges surrounding remote access infrastructure. VPN services are designed to provide remote connectivity, which means they can be exposed to untrusted networks. Vulnerabilities affecting these services can therefore create an attractive attack surface. The Cisco vulnerability demonstrates how an attacker may not need to obtain credentials or directly compromise protected systems to cause disruption. An unauthenticated request that triggers an unexpected firewall reload can potentially affect the availability of network services behind the appliance. **For security teams, this reinforces several priorities:** Know which remote access services are exposed. Track the software versions protecting those services. Monitor vendor advisories for exploitation status. Prioritize vulnerabilities with confirmed active exploitation. Apply vendor-provided security updates promptly. ## The Bigger Picture for Network Security CVE-2026-20349 is another reminder that network security appliances themselves need continuous security maintenance. Firewalls are often viewed as protective barriers around an organization's infrastructure. But because they operate at important network boundaries and can provide services such as VPN access, vulnerabilities in these devices can have a significant operational impact. The risk is particularly important when a vulnerability combines: - Remote exploitation - No authentication requirement - Availability impact - Confirmed exploitation Cisco's advisory confirms these characteristics for CVE-2026-20349. That makes rapid vulnerability management essential for organizations using affected Cisco ASA and FTD deployments. ## Conclusion Cisco has confirmed **active exploitation of CVE-2026-20349**, a high-severity vulnerability affecting certain configurations of Cisco Secure Firewall ASA and FTD Software. The flaw affects the Remote Access SSL VPN service and can allow an unauthenticated remote attacker to send a crafted HTTP request that causes an affected device to reload, resulting in a denial-of-service condition. The vulnerability affects specific software releases and configurations involving **SSL VPN, IKEv2 Remote Access VPN with client services, and FTD Zero Trust Network Access**. Cisco has also confirmed that **Secure Firewall Management Center Software is not affected**. There is **no workaround that addresses the vulnerability**, and Cisco has released hot fixes covering multiple ASA and FTD software branches. Because Cisco has confirmed exploitation in the wild, organizations running potentially affected firewall deployments should treat the issue as an immediate remediation priority. The most important response is straightforward: **Identify affected devices. Check the configuration. Verify the correct fixed release. Patch promptly. Validate the environment afterward.** CVE-2026-20349 shows why internet-facing security infrastructure cannot be treated as a set-and-forget control. **When the firewall itself becomes the attack surface, keeping it patched becomes part of the perimeter defense.** ## Original source https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF ## Tags `#Cisco` · `#Cybersecurity` · `#ZeroDay` · `#CVE202620349` · `#NetworkSecurity` · `#VPNSecurity` · `#FirewallSecurity` · `#Vulnerability` --- ## About this content This Markdown news article is the citation-grade twin of [Cisco Firewall Zero-Day CVE-2026-20349 Exploited in the Wild](https://xcademia.com/news/cisco-firewall-zero-day-cve-2026-20349-exploited-in-the-wild). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://xcademia.com/news/cisco-firewall-zero-day-cve-2026-20349-exploited-in-the-wild - Publisher: Xcademia — https://xcademia.com - Catalogue index: https://xcademia.com/llms-full.txt