DaystoPatch

CiscoExploited incident

Cisco Secure Firewall ASA and FTD Software Remote Access SSL VPN Denial of Service Vulnerability

CVE-2026-20349High, CVSS 8.6In CISA's Known Exploited Vulnerabilities catalog since 11 Aug 2026

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.

Response

Silence
0h
First public report to first vendor statementUnverified source
Exposure
0h
First public report to first fix
Follow-through
0h
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco PSIRT advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF, v1.0 (Wayback snapshot 2026-08-12)CuratedQuote verified

    In August 2026, the Cisco Product Security Incident Response Team (PSIRT) became aware of active exploitation of this vulnerability.

    Exploitation was disclosed in v1.0 ('First Published: 2026 August 11 16:39 GMT'). No earlier public report found.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f7dd4fa810f3a822…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    CISA KEV (CVE-2026-20349)ClaimedQuote verified11 Aug 2026

    Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

    Added to CISA's KEV catalog on 2026-08-11.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco advisory cisco-sa-asaftd-vpn-dos-dzv4mQFFClaimedQuote verified11 Aug 2026, 16:39 UTC

    Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability

    The vendor's own disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ec9f14b1f6a4edb0…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-20349ClaimedQuote verified11 Aug 2026, 17:06 UTC

    A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:cce1d3f381c5f622…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet11 Aug 2026, 19:55 UTC

    Ciscoは、Secure Firewall ASAおよびThreat Defense(FTD)ソフトウェアに存在する深刻度の高いサービス拒否(DoS)の脆弱性が、対象デバイスをリモートからクラッシュさせる攻撃で実際に悪用されていると警告しています。 CVE-2026-20349として追跡されているこの脆弱性は深刻度...

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet11 Aug 2026, 20:01 UTC

    Cisco Warns of Active Exploitation of VPN Flaw in ASA, FTD Software Cisco warns that a high-severity VPN flaw, CVE-2026-20349, is being actively exploited, allowing attackers to send crafted HTTP requests that can cause affected devices to reload and disrupt operations. This denial-of-service

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosureUnverified: no archived copy, quote not checked yet

    Cisco PSIRT advisory cisco-sa-asaftd-vpn-dos-dzv4mQFFCuratedQuote not checked yet

    First Published: 2026 August 11 16:39 GMT

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco advisory cisco-sa-asaftd-vpn-dos-dzv4mQFFClaimedQuote verified11 Aug 2026, 16:54 UTC

    Initial public release.

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:25134cbf69e03c1c…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    at disclosure

    Cisco PSIRT advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF, v1.0 (Wayback snapshot 2026-08-12)CuratedQuote verified

    Cisco has released the following hot fixes to address this vulnerability. Customers can download the hot fixes from the Software Center on Cisco.com.

    v1.0 shipped ASA hot fixes (89.16.4.50, 89.18.4.50, 9.20.4.235, 9.22.3.191, 9.23.1.211, 9.24.1.221) and FTD hot fixes for 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f7dd4fa810f3a822…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco advisory cisco-sa-asaftd-vpn-dos-dzv4mQFFClaimedQuote verified16 Sep 2026, 16:05 UTC

    Updated fixed release information and added reference to security hardening releases.

    CaveatRevision adds fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:25134cbf69e03c1c…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    at disclosure

    Cisco PSIRT advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF, v1.0 (Wayback snapshot 2026-08-12)CuratedQuote verified

    First Published: 2026 August 11 16:39 GMT

    v1.0 hot-fix tables cover every ASA train (9.16 and earlier through 9.24) and every FTD train (7.0 through 10.0). Revision 1.1 (2026-SEP-16) replaced hot fixes with the September 2026 hardening releases and lists FTD 10.1 -> 10.1.0 (first 10.1 release already fixed).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f7dd4fa810f3a822…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. cisco-sa-asaftd-vpn-dos-dzv4mQFF

    Recorded in the revision history

    Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability

    Version table: 13 rows added and 12 rows removed. One new row reads "9.16 and earlier | 9.16.4.103".

    • Fixed versions
    Version table rows
    Before9.16 1 | 89.16.4.50; 9.18 1 | 89.18.4.50; 9.20 | 9.20.4.235; 9.22 | 9.22.3.191
    After9.16 and earlier | 9.16.4.103; 9.18 | 9.18.4.94; 9.20 | 9.20.4.49; 9.22 | 9.22.3.26
    Earlier version captured 12 Aug 2026, 11:31 UTC: archived copyLater version captured 17 Sep 2026, 12:25 UTC: archived copyRecovered from archived copiesSnapshots 28ea9fa0e9… and 25134cbf69…Incident page

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
  • Cisco Secure Firewall Threat Defense (FTD) Software
How we built this timeline

Exploitation disclosed in the same advisory that shipped hot fixes, so world = vendor = First fix. ASA hot fixes for 9.16 and 9.18 use the '89.x' numbering and need ASDM 7.24.1.374 per the advisory footnote.

Found during internal security testing and also reported by Valerio Brussani. Denial of service only (device reload);

CVSS 8.6.

Related

Cisco report card