What Changed
Cisco warns that attackers are exploiting CVE-2026-20349 (CVSS 8.6), a denial-of-service flaw in Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Insufficient error checking when processing HTTP requests lets an unauthenticated remote attacker send a crafted request to the Remote Access SSL VPN service and force the device to reload.
Cisco has not said who is behind the attacks and has published no indicators of compromise. CISA added the flaw to its Known Exploited Vulnerabilities catalog with an August 14 deadline for federal agencies. The bug was found in internal testing and independently reported by researcher Valerio Brussani.
Who Is Exposed
Devices are affected when SSL listen sockets are enabled through IKEv2 Remote Access VPN with client services, SSL VPN, or Zero Trust Network Access on FTD. Secure Firewall Management Center is not affected. Fixes are available for ASA 9.16, 9.18, 9.20, 9.22, 9.23 and 9.24 and FTD 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0. There are no workarounds.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why This Is An Operations Problem
A firewall reload drops VPN users and can interrupt traffic for whole sites. Repeated crashes are also a way to force failover or create noise during another attack.
What To Verify First
- Identify ASA and FTD devices with remote-access VPN or ZTNA features enabled.
- Apply Cisco’s fixed releases or hotfixes.
- Review device logs for unexpected reloads since early August.
- Confirm high-availability pairs fail over cleanly in case a device is crashed before patching.
What Teams May Be Underestimating
Denial-of-service bugs are often deprioritized. This one is already used in attacks and has no workaround, which puts it in the patch-now group.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
