CVE-2026-20349

Think of your firewall’s SSL VPN like a building’s front door for remote access. This bug lets someone slam the door in a way that makes the firewall unexpectedly restart, which can stop VPN access until the system comes back up and stabilizes.

This matters if your business runs Cisco Secure Firewall Adaptive Security Appliance (ASA) software or Cisco Secure Firewall Threat Defense (FTD) software and you use the Remote Access SSL VPN service. It’s a remote denial-of-service risk that does not require login, so it becomes a concern when the SSL VPN endpoint can be reached from the internet. The risk applies when the vulnerable Remote Access SSL VPN service is reachable from the network an attacker can access (typically the public internet).

This should be treated as urgent because real-world exploitation is confirmed via CISA KEV listing. The public exploit exists, and the vulnerability can cause the device to reload, which means service disruption is a direct consequence once an attacker targets an exposed SSL VPN endpoint. Follow CISA guidance and apply mitigations or the vendor fix immediately.