CVE-2026-20349: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: yes — in CISA KEV since 2026-08-11
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-11 · updated 2026-10-26
Weakness: CWE-244

Description

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.  This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

Summary

CVE-2026-20349 is a high-severity (CVSS 8.6) heap inspection flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD Software, caused by insufficient error checking when processing HTTP requests. An unauthenticated remote attacker can send a crafted HTTP request to trigger an unexpected device reload, causing a denial of service. The flaw affects Cisco ASA Software and Cisco Firepower Threat Defense Software and is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation. Apply the mitigations specified in Cisco's vendor instructions and follow CISA BOD 26-04 patching guidance; if mitigations are unavailable, discontinue use of the product per BOD 26-04.

CVE-2026-20349 ثغرة عالية الخطورة (CVSS 8.6) من نوع فحص الذاكرة (heap inspection) في خدمة Remote Access SSL VPN ضمن Cisco Secure Firewall ASA وFTD Software، سببها نقص في التحقق من الأخطاء عند معالجة طلبات HTTP. يستطيع مهاجم بعيد غير مصادَق عليه إرسال طلب HTTP مصمم خصيصًا لإعادة تشغيل الجهاز بشكل غير متوقع، ما يؤدي إلى حالة حجب خدمة (DoS). تؤثر الثغرة في Cisco ASA Software وCisco Firepower Threat Defense Software، وهي مدرجة في كتالوج CISA للثغرات المعروفة باستغلالها مع استغلال نشط. طبّق التخفيفات وفق تعليمات Cisco واتبع إرشادات الترقيع في CISA BOD 26-04، وإن لم تتوفر التخفيفات فأوقف استخدام المنتج وفقًا لـ BOD 26-04.

Affected products

Cisco ASA Software: 9.16.1, 9.16.1.28, 9.16.2, 9.16.2.3, 9.16.2.7, 9.16.2.11 (+127)
Cisco Firepower Threat Defense Software: 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.0.2.1 (+58)

References

Get alerted when CVE-2026-20349 or the next vulnerability affects your stack