Cisco Warns of Active Exploitation of a Flaw in ASA and FTD

Cisco has warned customers about the active exploitation of a denial-of-service (DoS) vulnerability in its Secure Firewall ASA (Adaptive Security Appliance) and Threat Defense (FTD) software. The flaw allows attackers to remotely force vulnerable devices into a reboot.

What the vulnerability is

The flaw has been assigned the identifier CVE-2026-20349 and a severity score of 8.6 out of 10. It affects devices with remote-access services enabled and stems from insufficient error checking when processing HTTP requests.

According to Cisco, an attacker can send a specially crafted HTTP request to the Remote Access SSL VPN service of a vulnerable device, causing it to reboot and, as a result, denying service. Exploitation is possible remotely, without authentication or user interaction, as long as SSL listening sockets are enabled.

The vulnerable configurations include IKEv2 Remote Access VPN with client services, SSL VPN, and Zero Trust Network Access on FTD devices. The Secure Firewall Management Center (FMC) software is not affected, according to Cisco.

Fixes and recommendations

Cisco has released emergency hot fixes for the affected ASA releases 9.16, 9.18, 9.20, 9.22, 9.23, and 9.24, as well as for FTD versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. There are no workarounds, so the company strongly urges users to upgrade to a fixed version.

The Cisco PSIRT response team said it learned of the active exploitation of CVE-2026-20349 in August 2026, but did not disclose details about the attacks — neither who is behind them nor which organizations were targeted. The advisory also provides no indicators of compromise.

The vulnerability was discovered during Cisco's internal security testing and independently reported to the company by researcher Valerio Brussani.

Separately, this month Cisco disclosed that the Secure Endpoint connector for Windows, macOS, and Linux is affected by ClamAV vulnerabilities for which public exploits already exist. Patches for them are not yet available and will be released later this month.

Source: Bleeping Computer