The Firewall Crash Bug Cisco Has Now Shipped Twice: CVE-2026-20349 and Its 2024 Twin
An unauthenticated, actively-exploited DoS in Cisco ASA/FTD's Remote Access VPN service — CVSS 8.6, no workaround, and the same score as the bug that opened the door to the ArcaneDoor espionage campaign two years ago.
A crafted HTTP request, an unauthenticated attacker, a rebooted firewall
On August 11, 2026, Cisco disclosed CVE-2026-20349: an unauthenticated, remotely triggerable denial-of-service flaw in the Remote Access SSL VPN service of Secure Firewall ASA and Threat Defense (FTD) software. Cisco's PSIRT says it is already being exploited — and it confirmed active exploitation in the same advisory that announced the bug, which is not a routine disclosure pattern.
Scores as of 2026-08-15live record →
The root cause, per Cisco's own advisory: "insufficient error checking when processing HTTP requests" in the RA SSL VPN service. Send it a malformed request and the device reloads. No authentication, no user interaction, no crash dump needed by the attacker — just network reachability to the VPN-facing interface.
No workaround. Hotfix only.
| Track | Fixed in |
|---|---|
| ASA 9.16 | 89.16.4.50 |
| ASA 9.18 | 89.18.4.50 |
| ASA 9.20 | 9.20.4.235 |
| ASA 9.22 | 9.22.3.191 |
| ASA 9.23 | 9.23.1.211 |
| ASA 9.24 | 9.24.1.221 |
| FTD | Platform-specific hotfix across the 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 trains — see the Cisco advisory's hotfix table for your exact build |
This isn't the first 8.6 on this exact service
Run the CVSS score back two years and you land on CVE-2024-20353 — also 8.6, also AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, also an unauthenticated crash triggered by a malformed HTTP request against the ASA/FTD management-and-VPN web server. That bug wasn't an isolated crash-and-forget: it was one half of the opening move in ArcaneDoor, a state-linked espionage campaign against government ASA deployments that Cisco Talos attributed to actor UAT4356 (Microsoft: Storm-1849).
Two DoS bugs, same score, same service class — different outcomes so far
- CVSS 8.6, CWE-835 (infinite loop)
- Paired with CVE-2024-20359 — a separate, admin-privilege code-execution bug
- The pairing let UAT4356/Storm-1849 install the in-memory "Line Dancer" shellcode loader and "Line Runner" persistent implant
- Confirmed nation-state espionage campaign against government networks, active since ~July 2023
- CVSS 8.6, CWE-244 as tagged by Cisco
- No companion RCE/privesc bug has been disclosed alongside it
- Cisco attributes discovery to internal testing plus external researcher Valerio Brussani
- Confirmed active exploitation, but no attribution, backdoor, or campaign name published by Cisco or CISA as of this writing
A pattern, not a one-off
CVE-2026-20349 is at least the fourth Remote-Access-VPN-adjacent bug in Cisco's ASA/FTD line to land on CISA's Known Exploited Vulnerabilities catalog since 2023. None of them share a root cause, but all of them hit the same target: the unauthenticated, internet-facing VPN termination surface that every ASA/FTD customer running remote access has to expose by definition.
ASA/FTD Remote Access VPN in CISA KEV, 2023–2026
- CVE-2023-20269 added to KEVRemote access VPN feature, unauthenticated brute-force login enumeration; CVSS 5.0
- CVE-2024-20353 + CVE-2024-20359 disclosedArcaneDoor's opening pair — DoS (8.6) paired with a code-execution bug used to plant in-memory implants on government ASAs
- CVE-2024-20481 added to KEVRAVPN resource-exhaustion DoS via mass authentication requests; tied to a Cisco Talos-documented brute-force campaign
- CVE-2025-20333 (RCE, CVSS 9.9) + CVE-2025-20362 added to KEVVPN web server RCE; part of ArcaneDoor's 2025 evolution with the RayInitiator bootkit and LINE VIPER implant
- CVE-2026-20349 disclosed and added to KEVRA SSL VPN DoS, CVSS 8.6 — same score as the 2024 ArcaneDoor opener; federal deadline 2026-08-14
| Label | Value |
|---|---|
| CVE-2023-20269 | 21.6 |
| CVE-2024-20353 | 70.7 |
| CVE-2024-20481 | 15.9 |
| CVE-2025-20333 | 40.4 |
| CVE-2026-20349 | 0.87 |
What to actually do about it
- Inventory every ASA and FTD device and check which ones have SSL VPN, IKEv2 remote-access client services, or ZTNA enabled — those are the exposed surface.
- Patch to the hotfix build for your track (see table above); there is no configuration workaround, only the fix.
- If you run high-availability pairs, patch and verify both the active and standby nodes — a patched active node with an unpatched standby is still exposed on failover.
- Deploy Cisco's Snort rules 46897 and 59654 if you run Snort-based intrusion detection alongside the appliance.
- Restrict Remote Access SSL VPN reachability to known source IP ranges where your remote-access population allows it.
- Monitor for unexplained device reloads on ASA/FTD units in the interim — Cisco has not published IOCs for this specific campaign, so a crash-without-cause is currently the only observable signal.
Vulnerability data current as of 2026-08-15live record →