Cisco fixes vulnerability exploited to DoS its firewalls (CVE-2026-20349)

Cisco has confirmed that attackers are actively exploiting a high-severity vulnerability, CVE-2026-20349, to trigger denial-of-service conditions on its firewall appliances. The flaw affects the Remote Access SSL VPN service running on Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) software, specifically when IKEv2, SSL VPN, or ZTNA features are enabled. An unauthenticated attacker can send a specially crafted HTTP request to force the device to reload unexpectedly, interrupting network operations.

Cisco PSIRT detected the active exploitation in August 2026, and CISA has since added the issue to its Known Exploited Vulnerabilities catalog with a remediation deadline for US civilian federal agencies of August 14, 2026. To mitigate the risk, administrators should apply the recently released hot fixes for ASA versions 9.16 through 9.24 and FTD versions 7.0 through 7.7 and 10.0, as no workarounds are available.