CVE-2026-20349, Cisco Secure Firewall ASA/FTD: one crafted HTTP request to the Remote Access SSL VPN reloads the device, exploitation confirmed, no workaround and a three-day KEV deadline

Cisco published advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF on 2026-08-11 at 16:39 GMT covering CVE-2026-20349, and states plainly that "In August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability" (Cisco PSIRT, 2026-08-11). The flaw is insufficient error checking when the Remote Access SSL VPN service on Secure Firewall ASA and Secure Firewall Threat Defense processes HTTP requests: an unauthenticated remote attacker sends a crafted HTTP request to that service and causes the device to reload, producing a denial of service. Cisco scores it CVSS 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) under CWE-244, rates the advisory High, and states "There are no workarounds that address this vulnerability" (Cisco PSIRT, 2026-08-11).

The exposure question is a configuration question, and Cisco makes it checkable rather than leaving it to guesswork. Three features enable the SSL listen sockets the attack reaches: IKEv2 remote-access VPN with client services (crypto ikev2 enable <interface> client-services port <ports>), SSL VPN (webvpn enable <interface>), and Zero Trust Network Access (zero-trust enable, FTD only) (Cisco PSIRT, 2026-08-11). A device with none of them configured is not affected regardless of version. Affected releases are ASA 9.16, 9.18, 9.20, 9.22, 9.23 and 9.24 and FTD 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0, and Cisco confirms Secure Firewall Management Center is not affected. Cisco first remediated the flaw with per-train hot fixes and has since replaced them with hardening releases, which are now the fixed releases it recommends (see the update below).

CISA added CVE-2026-20349 to its Known Exploited Vulnerabilities catalog on 2026-08-11 with a 14 August due date, and catalogues it as a heap-inspection weakness (CISA, 2026-08-11). The US federal deadline is not this constituency's clock, but the listing itself is the jurisdiction-agnostic part: it is independent confirmation that the flaw is being used, on a class of device (the remote-access VPN gateway) where an outage is a availability incident for every remote worker at once.

Two things keep this at high rather than critical. Cisco scopes the impact to a device reload with no confidentiality or integrity effect in its own vector string, and names no exploiting cluster or targeted sector. What makes it worth acting on inside the week anyway is the combination the advisory itself documents: unauthenticated, single-request, no workaround, on a service whose whole purpose is to be reachable from the internet. Detection here is unusually blunt and unusually reliable; the exploitation signal is the impact. Repeated unexplained reloads or crash-dump generation on an internet-facing ASA/FTD, particularly clustered around inbound HTTP requests to the SSL VPN listener rather than around a configuration change or a scheduled reload, is the hunt; syslog reload events correlated against the VPN service's request logs will separate a exploitation attempt from an operator-initiated reboot, because the latter carries a corresponding administrative session and the former does not.