~/f4n6 $ grep -r "CVE-2026-20349 — Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) : Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability" ./investigations/ --include="*.md"

CVE-2026-20349 — Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) : Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

Jeff Davies 11 Aug 2026 5 min read

1. Executive summary

CVE-2026-20349 is a HIGH-severity (CVSS 8.6) heap inspection vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. An unauthenticated, remote attacker can send a crafted HTTP request to the SSL VPN service, causing the device to reload unexpectedly and producing a denial-of-service (DoS) condition. The vulnerability stems from insufficient error checking when processing HTTP requests (CWE-244). It is NOT currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalogue. EMEA financial services running affected ASA/FTD versions with internet-exposed SSL VPNs face direct operational disruption risk to perimeter security and remote access infrastructure.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 24: digital operational resilience testing — general requirements Internet-exposed SSL VPN on perimeter firewall is a critical ICT function vulnerable to unauthenticated remote DoS. Clients must include this CVE in resilience testing of externally facing ASA/FTD assets and verify mitigations under their testing programme.
DORA Art. 19: reporting of major ICT-related incidents to competent authorities A successful exploit causes unexpected device reload, potentially disrupting VPN connectivity and perimeter security for financial operations. If exploited, clients must assess whether the resulting DoS constitutes a major ICT-related incident and report to competent authorities per DORA timelines.

3. Technical analysis & attack chain

Affected products and confirmed versions

  • Cisco Secure Firewall ASA Software — versions 9.16.x (including 9.16.1, 9.16.1.28, 9.16.2, 9.16.2.3, 9.16.2.7, 9.16.2.11, 9.16.2.13, 9.16.2.14, 9.16.3, 9.16.3.3, 9.16.3.14, 9.16.3.15, 9.16.3.19, 9.16.3.23, 9.16.4, 9.16.4.9, 9.16.4.14, 9.16.4.19, 9.16.4.27), 9.18.x (including 9.18.1, 9.18.1.3, 9.18.2, 9.18.2.5, 9.18.2.7, 9.18.2.8, 9.18.3, 9.18.3.39, 9.18.3.46), 9.19.x (including 9.19.1, 9.19.1.5, 9.19.1.9, 9.19.1.12)
  • Cisco Secure Firewall FTD Software — affected versions not fully enumerated in the source material; assume the same version ranges apply pending vendor advisory confirmation.

Attack chain (confirmed)

  1. Reconnaissance: The attacker identifies an affected ASA/FTD device with the Remote Access SSL VPN service enabled and reachable on its public-facing interface.
  2. Initial access vector: No authentication is required. The attacker sends a crafted HTTP request directly to the Remote Access SSL VPN service.
  3. Vulnerability mechanism: The SSL VPN service performs insufficient error checking when processing the crafted HTTP request, resulting in a heap inspection error (CWE-244). The flawed error handling causes the device process to fail.
  4. Impact: The affected device reloads unexpectedly. This produces a denial-of-service condition — the firewall/VPN gateway is temporarily offline, disrupting all traffic transiting the device including VPN connectivity, site-to-site tunnels, and perimeter inspection.
  5. Repeat exploitation: An attacker can repeat the request after the device recovers, causing sustained or cyclic reloads.

CVSS vector: AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H — network-exploitable, low attack complexity, no privileges, no user interaction, changed scope (the DoS impacts beyond the vulnerable component), no confidentiality or integrity impact, high availability impact.

Notes on scope and confidence: The vulnerability affects only availability. There is no indication of code execution, data exfiltration, or persistence. The CISA source material references BOD 26-04 (a US federal directive) and a remediation due date of 2026-08-14; this is a US government compliance deadline and does not apply to EMEA clients, though it signals the urgency Cisco and CISA assign to the flaw. No ransomware campaign use is confirmed (status: Unknown). No threat actor attribution is present in the source material.

4. Mitigation & containment

P1 — Within 24 hours

  • Inventory and assess exposure: Identify all ASA/FTD devices running affected versions (9.16.x, 9.18.x, 9.19.x). Determine which have Remote Access SSL VPN enabled and are internet-facing.
  • Containment — disable or restrict SSL VPN: If the Remote Access SSL VPN service is not required on a given device, disable it. If it is required, restrict access to known source IP ranges (corporate egress, trusted geographies) using ACLs or control-plane policing until a patch is available.
  • Review vendor advisory: Monitor https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF for the official fix and specific patch versions.

P2 — Within 72 hours

  • Apply vendor patch: Once Cisco releases fixed software versions, upgrade all affected ASA/FTD devices. Prioritise internet-exposed devices first, then internal-facing devices.
  • Verify SSL VPN configuration: After patching, confirm the SSL VPN service is functioning correctly and that no unintended exposure remains.
  • Implement rate limiting / connection thresholds: Where patching is delayed, configure connection and rate limits on the SSL VPN listener to slow repeated exploit attempts. This does not prevent exploitation but may reduce reload frequency.

P3 — Within 7 days

  • Update vulnerability management records: Record CVE-2026-20349 as remediated in asset inventories and risk registers.
  • Review VPN architecture: Assess whether SSL VPN termination can be moved behind a dedicated VPN concentrator or load balancer to reduce direct exposure of ASA/FTD management and VPN planes.
  • Validate logging and alerting: Ensure device reload events, SSL VPN connection logs, and HTTP error logs on ASA/FTD are forwarded to SIEM and trigger alerts for unexpected reloads.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, URLs) are available in the source material.

Behavioural indicators

Behaviour Where to observe Confidence
Unexpected device reload of ASA/FTD with SSL VPN enabled Device system logs, SNMP traps, monitoring platform High — this is the direct impact of successful exploitation
Crafted HTTP requests to SSL VPN service preceding reload ASA/FTD HTTP/SSL VPN logs, firewall access logs, netflow Medium — consistent with attack vector but not uniquely distinctive
Repeated reload cycles on the same device Monitoring platform, uptime logs Medium — suggests sustained exploitation attempts

6. Detection

Insufficient indicators to author detection rules. The source material does not contain distinctive strings, command-line artefacts, file names, or network signatures specific to the exploit payload. Detection should rely on the behavioural indicators in §5 — specifically, alerting on unexpected ASA/FTD device reload events correlated with HTTP requests to the SSL VPN service in the preceding minutes.

CVE assessment

1 referenced CVE

CVE CVSS Exploited EPSS Summary
CVE-2026-20349 8.6 High — — A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and C…

7. Sources

  • NVD, CVE-2026-20349 detail page, https://nvd.nist.gov/vuln/detail/CVE-2026-20349, published 2026-08-10
  • Cisco Security Advisory, cisco-sa-asaftd-vpn-dos-dzv4mQFF, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF

8. Adverse Trace position

CVE-2026-20349 is a HIGH-severity (CVSS 8.6) unauthenticated remote denial-of-service vulnerability in a critical perimeter device. The attack requires no credentials and low complexity — any attacker who can reach the SSL VPN service can trigger a device reload. For EMEA financial services, the primary risk is operational disruption to VPN connectivity and perimeter inspection, not data breach. The vulnerability is not currently exploited in the wild (not in CISA KEV; ransomware use unknown), but the ease of exploitation and the criticality of affected devices warrant urgent patching or containment. We are tracking this as a P1 advisory and will update clients when Cisco releases fixed software versions or if exploitation is observed. Clients should immediately inventory ASA/FTD devices with SSL VPN enabled and apply containment where exposure is confirmed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies