CVE-2026-20349: Cisco ASA and FTD — Remote DoS via VPN Heap Inspection

Background

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) are among the most widely deployed firewall and VPN platforms in enterprise and government networks. These appliances routinely serve as the primary remote access gateway for entire organisations, with SSL VPN endpoints (AnyConnect/Secure Client) exposed to the internet to enable workforce connectivity. Their central network position — sitting inline for production traffic and managing remote access — makes them critical infrastructure whose unavailability directly disrupts operations.

CVE-2026-20349 is a heap inspection vulnerability in the SSL VPN component of Cisco ASA and FTD software. An unauthenticated remote attacker can send a crafted HTTP request to the device’s SSL VPN service and cause the device to reload unexpectedly, resulting in a denial of service condition. The attack requires no authentication and no user interaction.

Technical Mechanism

The vulnerability is classified as CWE-244 (Improper Clearing of Heap Memory Before Release), colloquially called a heap inspection vulnerability. In this class of flaw, sensitive data — potentially including cryptographic material, session tokens, or configuration data — remains readable in heap memory after the memory is released. The vulnerability here specifically occurs during HTTP request processing in the VPN web server component.

An attacker sends a crafted HTTP request to the device’s SSL listen socket. Insufficient error checking in the request processing path triggers an unexpected condition that causes the affected process to reload the device. On Cisco ASA and FTD hardware, a process reload results in a full device restart, interrupting all in-progress VPN sessions and network traffic transiting the firewall.

The practical impact is that any attacker with network access to the VPN service endpoint — typically TCP port 443 on the firewall’s outside interface — can repeatedly trigger device restarts, sustaining a denial of service condition that prevents legitimate remote access and may disrupt critical network paths if the firewall sits in-line for production traffic.

Note that Cisco provides no configuration-level workaround that prevents the vulnerability while keeping the VPN service running — the flaw is in request processing that cannot be selectively disabled.

Real-World Exploitation Evidence

Active exploitation of CVE-2026-20349 was observed in August 2026, preceding CISA’s KEV addition on 11 August. BleepingComputer reported Cisco’s warning to customers about exploitation, with the advisory noting that the vendor was “aware of malicious use” of the vulnerability. CISA added CVE-2026-20349 to the Known Exploited Vulnerabilities catalog on 11 August 2026, with a remediation due date of 14 August 2026 for federal agencies — a highly compressed timeline reflecting active exploitation in the wild.

The attack surface for internet-facing Cisco ASA and FTD devices is large: these appliances are ubiquitous in enterprise and government networks, and their SSL VPN endpoints are routinely exposed to the internet. Attackers seeking to disrupt access to a target organisation, or to create conditions that disrupt security monitoring during a separate intrusion, can use a DoS of this type as a component of a broader attack.

There is no public attribution of exploitation to a specific threat actor group, but the pattern is consistent with prior Cisco firewall targeting observed from nation-state actors seeking to disrupt critical infrastructure or impede defensive response. Cisco’s research page on continued attacks against ASA and FTD devices indicates that threat actors have been systematically probing and exploiting Cisco firewall vulnerabilities throughout 2025 and 2026, treating these devices as high-value targets due to their central network position.

Impact Assessment

Successful exploitation forces an immediate full device reload, terminating all active VPN sessions and interrupting network traffic transiting the firewall. Because ASA and FTD appliances often serve as the sole remote access gateway for an organisation, sustained exploitation takes the entire remote workforce offline.

While the CVSS score of 8.6 is elevated rather than critical, the operational impact in real environments is disproportionate to the numerical score. In Cisco environments where firewall management is also accessible through the VPN interface, exploitation may also sever out-of-band management access during an incident response — preventing defenders from restoring the device while an attacker continues to trigger reloads.

Because the vulnerability triggers a device reload, live forensic data is cleared at restart, complicating post-incident investigation. Organisations in sectors that depend on continuous remote access — financial services, healthcare, government, and critical infrastructure operators — face the greatest exposure. Attackers can use this vulnerability to create access disruption as a precursor to or distraction during a broader intrusion, compounding its effective impact.

Affected Versions

Devices without these features enabled are not affected. Cisco’s advisory contains the full fixed software table with specific fixed release versions per software train; refer to Cisco Security Advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF for the definitive patch matrix.

Remediation Steps

1. Apply the Cisco-provided software update referenced in advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF. The fixed release versions are detailed in the advisory’s software table.

2. Organisations that cannot patch immediately should evaluate the following interim mitigations:

   • Restrict access to the SSL VPN interface to known IP ranges (for use cases where source IPs are predictable, such as split-tunnel configurations with a known egress)
   • Where operationally feasible, temporarily disable SSL VPN if alternative access methods exist and remote access is not critical
   • Deploy rate limiting or connection-count limits on the external interface to the VPN service port to reduce the effectiveness of sustained DoS attacks

3. Configure persistent external syslog if not already in place. Because device reloads clear live forensic data, an external syslog server is the only reliable source of pre-crash log data for post-incident analysis.

Detection Guidance

Log sources: Cisco ASA/FTD system logs (syslog); SNMP traps; network monitoring for device availability; out-of-band management logs.

What to look for:

• Unexpected device reloads correlating with increased HTTP traffic to TCP/443 on the outside interface
• Syslog messages indicating process termination or crash preceding the reload
• High-volume requests from a small number of source IPs to the VPN endpoint immediately before an outage
• Repeated short-duration availability failures that recover after each reload but recur — the signature pattern of an attacker maintaining persistent DoS via repeated trigger

Forensic note: Because the vulnerability triggers a device reload, live forensic data is cleared at restart. Configure persistent syslog to an external server if not already in place — this is the only reliable source of pre-crash log data for post-incident analysis.

Threat hunting: Correlate any period of unexplained ASA/FTD downtime in recent weeks with connection logs on upstream devices to identify source IPs that were sending anomalous request volumes to port 443 at the time of the outage.

Timeline

References

• Cisco Security Advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF
• CISA KEV Catalog — CVE-2026-20349
• NVD — CVE-2026-20349