1. Executive summary
Cisco has disclosed CVE-2026-20349, a high-severity vulnerability (CVSS 8.6) in Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software. The flaw stems from insufficient error checking when processing HTTP requests and allows an unauthenticated, remote attacker to cause a device reload, resulting in a denial-of-service condition. CISA has added the CVE to its Known Exploited Vulnerabilities (KEV) catalogue, confirming active exploitation in the wild; federal agencies have a remediation deadline of August 14. EMEA financial services running Cisco ASA/FTD firewalls with remote-access (VPN) exposure face immediate risk of externally triggered service disruption.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item beyond standard incident-management and testing obligations. The vulnerability is a vendor product flaw requiring patching under routine ICT operational resilience practices; no distinctive trigger fact narrows to a specific article in the provided regulatory reference.
3. Technical analysis & attack chain
Confirmed CVE: CVE-2026-20349 — CVSS 8.6 (high severity). CISA-KEV: listed, actively exploited. No MITRE actor profile is associated with this CVE; attribution to any named threat actor is unconfirmed.
Affected products
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Software — multiple versions
- Cisco Secure Firewall Threat Defense (FTD) Software — multiple versions
Attack chain (confirmed steps)
- Initial access vector: The attacker targets a Cisco ASA or FTD device accessible via its remote-access VPN connection. No authentication is required.
- Vulnerability mechanism: The flaw is in the software's HTTP request processing path. The device performs insufficient error checking when handling inbound HTTP requests. An attacker sends deliberately malformed or error-riddled HTTP requests to the firewall through the remote-access connection interface.
- Trigger condition: The malformed HTTP requests exploit the lack of error-checking logic, causing the device to encounter an unhandled error state.
- Impact: The device reloads unexpectedly, producing a denial-of-service condition. All traffic inspection, VPN termination, and routing functions served by the appliance are interrupted during the reload cycle.
- Persistence of effect: The vulnerability is a crash/reload trigger, not a code-execution or persistence primitive. Repeated exploitation can sustain the DoS condition by forcing consecutive reloads.
Key technical notes
- The vulnerability is exploitable remotely without authentication, increasing exposure for internet-facing management or VPN interfaces.
- Cisco has released fixed software versions for both ASA and FTD; specific version numbers are not detailed in the available source material. Clients should consult Cisco's advisory directly for the exact fixed-version matrix.
- The ANSSI France CERT (CERTFR-2026-AVI-1010) independently corroborates that CVE-2026-20349 is actively exploited, consistent with the CISA KEV listing.
Context — related but distinct Cisco advisories: ANSSI also published CERTFR-2026-AVI-0825 (2 July 2026) covering multiple Cisco vulnerabilities enabling remote DoS and data confidentiality impact, and CERTFR-2026-AVI-0975 (6 August 2026) covering multiple Cisco vulnerabilities enabling remote code execution, DoS, and data confidentiality impact. These are separate advisory sets and should not be conflated with CVE-2026-20349. A separate Cisco SD-WAN zero-day referenced in corpus-5 (no CVE resolved in verified data) is also distinct; no patch was available at time of that report.
4. Mitigation & containment
P1 — within 24 hours
- Identify all Cisco ASA and FTD firewalls in the estate, prioritising devices with internet-facing remote-access VPN interfaces.
- Check Cisco's advisory for CVE-2026-20349 and determine the fixed software version applicable to each deployed version. Upgrade to the fixed version immediately on all externally exposed devices.
- If immediate patching is not feasible, restrict access to the firewall's HTTP/remote-access management interface to trusted internal IP ranges only via upstream ACLs or border filtering. This reduces the unauthenticated remote attack surface.
- Monitor affected devices for unexpected reload events; correlate with HTTP request logs to detect exploitation attempts.
P2 — within 72 hours
- Complete patching of all remaining ASA and FTD devices, including internal-only units.
- Review firewall management plane exposure: confirm that HTTP/ASDM interfaces are not reachable from untrusted networks.
- Validate that VPN termination points are not co-located with management interfaces in a way that allows HTTP request injection from unauthenticated sessions.
P3 — within 7 days
- Conduct a retrospective scan of device uptime logs and reload events over the past 30 days to identify any historical exploitation that may have been attributed to "hardware instability."
- Ensure vulnerability management processes include Cisco ASA/FTD as a high-priority asset class given the repeated history of disclosed flaws (corpus-6 references a September 2025 CISA emergency directive for a separate ASA campaign affecting ~50,000 devices).
5. Indicators of compromise
No atomic indicators of compromise (IPs, domains, hashes, URLs) are available in the source material. The sources describe observable behaviour only.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Unexpected device reload of Cisco ASA/FTD firewall | Device system logs, SNMP traps, monitoring platform uptime alerts | High — directly described by Cisco advisory |
| Malformed or error-riddled HTTP requests sent to firewall remote-access interface | Firewall access logs, HTTP/ASDM request logs, network IDS/IPS | Medium — mechanism described; specific request patterns not detailed |
| Repeated reload cycles indicating sustained DoS exploitation | Device uptime monitoring, SIEM correlation of reload events | Medium — inferred from DoS mechanism |
6. Detection
Insufficient indicators to author detection rules. The source material describes the vulnerability mechanism (insufficient error checking on HTTP requests causing device reload) but does not provide specific HTTP request patterns, payloads, user-agent strings, or other artefacts that could be encoded into a YARA or Sigma rule. Clients should monitor for the behavioural indicators in §5: unexpected ASA/FTD reload events correlated with HTTP request activity on remote-access interfaces.
7. Sources
- Cybersecurity Dive — "Cisco says software vulnerability could let hackers crash firewalls" — https://www.cybersecuritydive.com/news/cisco-firewall-vulnerabilities-vpn-crash/827688/ — 2026-08-12
- SecurityWeek — "Cisco Patches Firewall Zero-Day Exploited for DoS Attacks" — https://www.securityweek.com/cisco-patches-firewall-zero-day-exploited-for-dos-attacks/ — 2026-08-12
- The Hacker News — "Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS" — https://thehackernews.com/2026/08/cisco-asa-and-ftd-flaw-exploited-in.html — 2026-08-12
- ANSSI France CERT — "Vulnérabilité dans les produits Cisco" (CERTFR-2026-AVI-1010) — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1010/ — 2026-08-12
- ANSSI France CERT — "Multiples vulnérabilités dans les produits Cisco" (CERTFR-2026-AVI-0825) — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0825/ — 2026-07-02
- ANSSI France CERT — "Multiples vulnérabilités dans les produits Cisco" (CERTFR-2026-AVI-0975) — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0975/ — 2026-08-06
- Cybersecurity Dive — "Cisco warns of zero day flaw in SD-WAN is being exploited" — https://www.cybersecuritydive.com/news/cisco-zero-day-flaw-sd-wan-exploited/822138/ — (date not specified)
8. Adverse Trace position
CVE-2026-20349 is a high-severity (CVSS 8.6), unauthenticated, remotely exploitable DoS vulnerability in widely deployed Cisco Secure Firewall ASA and FTD software. CISA KEV listing confirms active exploitation. The risk to EMEA financial services is direct: any institution running affected ASA/FTD firewalls with internet-facing remote-access VPN interfaces is exposed to externally triggered service disruption. No threat actor attribution is confirmed. No atomic IOCs are available; detection must rely on behavioural monitoring for unexpected device reloads. We assess this as a P1 remediation item — patch all externally exposed devices within 24 hours and all remaining devices within 72 hours. Adverse Trace will monitor for emerging IOCs, exploit details, and any actor attribution; this advisory will be updated if corroborated technical indicators become available.
Published via PulseTrace — Adverse Trace threat intelligence.