A high-severity vulnerability (CVE-2026-20349) is being leveraged by attackers to temporarily interrupt the operation of Cisco firewalls, the company has confirmed.
The flaw has been added to CISA’s Known Exploited Vulnerabilities catalog and needs to be remediated by US civilian federal agencies by August 14, 2026.
Details about the attacks are currently under wraps. Cisco only shared that its Product Security Incident Response Team (PSIRT) became aware of active exploitation of this vulnerability in August 2026.
About CVE-2026-20349
CVE-2026-20349 affects the Remote Access SSL VPN service for:
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
- Cisco Secure Firewall Threat Defense (FTD) Software
Affected features are IKEv2 Remote Access VPN (with client services), SSL VPN, and Zero Trust Network Access (ZTNA). An appliance is vulnerable to attack if it runs an affected software version and if one of these features is enabled (i.e., the SSL listen sockets are active).
CVE-2026-20349 can be triggered by attackers via a specially crafted HTTP request to the vulnerable service. The request could cause the security appliances to reload unexpectedly, resulting in a denial of service condition.
An attacker can exploit this vulnerability without needing to authenticate or trick a user into any action.
To address the issue, Cisco has issued hot fixes covering ASA software versions 9.16, 9.18, 9.20, 9.22, 9.23, and 9.24, and FTD software versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. There are no available workarounds, and no specific indicators of compromise.
According to the security advisory, the vulnerability was found by Cisco during internal security testing, but also reported by security researcher Valerio Brussani.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
