ciscoasaftddosvulnerability

Cisco ASA and FTD Remote DoS Flaw Actively Exploited

Critical CVE-2026-20349 in Cisco ASA and FTD allows unauthenticated attackers to trigger a denial-of-service via crafted VPN requests, affecting multiple versions and configurations.

Diego Diaz
5 min

What Happened

On August 12, 2026 Cisco disclosed that a high‑severity vulnerability (CVE-2026-20349, CVSS 8.6) in its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software was being actively exploited in the wild. The flaw enables an unauthenticated attacker to send a crafted HTTP request to the Remote Access SSL VPN service, causing the device to reload and enter a denial‑of‑service (DoS) state. The Hacker News reported the advisory on the same day.

Technical Analysis

The root cause is insufficient error checking when processing HTTP requests targeting the Remote Access SSL VPN service. When the malicious request is received, the appliance crashes and automatically reloads, interrupting VPN connectivity for all users. Affected configurations include IKEv2 Remote Access VPN with client‑services, SSL‑VPN, and Zero Trust Network Access. The vulnerability impacts ASA versions 9.161, 9.181, 9.20, 9.22, 9.23, 9.24 and FTD version 7.0, with fixes released for each version. Details and version‑specific fixes are listed in Cisco’s advisory Cisco Security Advisory and also referenced in the Hong Kong CERT bulletin HKCERT.

Who's Affected

Any organization running the vulnerable ASA or FTD releases with the Remote Access SSL VPN service enabled is at risk. Large‑scale brute‑force attacks observed in early 2024 already targeted similar VPN services across many vendors, amplifying the impact of this flaw. Enterprises that expose VPN portals to remote employees, contractors, or partners are especially vulnerable. The issue has been added to the U.S. CISA Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch by August 14, 2026.

How to Protect Yourself

  • Immediately apply Cisco’s hotfixes for the affected ASA and FTD versions. Patch links are provided in the advisory above.
  • Verify that the Remote Access SSL VPN service is disabled if not required. Use show running-config webvpn | include ^enable to confirm.
  • Enable multi‑factor authentication (MFA) for VPN logins to reduce the risk of credential‑theft attacks that often precede exploitation.
  • Monitor VPN logs for unusually high rates of authentication attempts or malformed HTTP requests and alert on spikes.
  • Consider segmenting VPN traffic on dedicated firewalls and applying rate‑limiting controls.

The Sable Angle

Our Red Team frequently exploits mis‑configured VPN appliances to gain initial footholds in target networks. The CVE‑2026‑20349 vector aligns with real‑world attack chains we have documented in our Sable research library. By automating crafted HTTP requests against vulnerable SSL‑VPN endpoints, we can trigger immediate service disruption, forcing defenders to divert resources.

While Sable does not advise intentional DoS attacks, understanding this flaw helps security teams harden their perimeter. Deploying the latest patches, disabling unnecessary VPN services, and applying strict authentication controls are proven defensive measures that mitigate both the denial‑of‑service risk and the broader lateral‑movement opportunities that follow initial compromise.