Cisco ASA & FTD Remote Access SSL VPN Denial of Service Zero-Day (CVE-2026-20349) Actively Exploited in the Wild

Executive Summary¶

A high-severity denial-of-service (DoS) vulnerability, CVE-2026-20349, in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software is being actively exploited in the wild. This zero-day flaw, with a CVSS score of 8.6, allows an unauthenticated remote attacker to send a specially crafted HTTP request to the Remote Access SSL VPN service, causing the affected device to unexpectedly reload. This results in a DoS condition, interrupting VPN sessions and potentially disrupting access to critical network resources. Cisco has released hotfixes, and CISA has added this CVE to its Known Exploited Vulnerabilities (KEV) catalog, emphasizing the urgent need for remediation.

Vulnerability Breakdown: CVE-2026-20349¶

CVE-2026-20349 is a vulnerability in the Remote Access SSL VPN service of Cisco ASA and FTD software. The core issue is categorized as an Improper Handling of Exceptional Conditions (CWE-244), specifically due to insufficient error checking.

• Description: The vulnerability arises from inadequate error checking when the Cisco ASA/FTD device processes specially crafted HTTP requests directed to its Remote Access SSL VPN service. An unauthenticated, remote attacker can send such a request, triggering an unhandled exception or critical fault that forces the device to reload.
• Impact: A successful exploit leads to a denial-of-service condition. This means:
  • Active VPN sessions are terminated.
  • Remote users (employees, administrators, third-parties) lose connectivity to internal networks and applications.
  • If the ASA/FTD device acts as a primary network gateway, repeated exploitation can cause significant operational disruption across the organization.
  • While severe, Cisco has not indicated that this flaw enables remote code execution, information theft, or persistent device compromise.
• Affected Products & Configurations: The vulnerability impacts Cisco ASA or FTD installations when running vulnerable software releases and at least one of the following remote-access configurations is enabled, which utilize SSL listen sockets:
  • IKEv2 Remote Access VPN with client services: Configured with crypto ikev2 enable <interface_name> client-services port <port_numbers>
  • SSL VPN: Configured through webvpn and enable <interface_name>
  • Zero Trust Network Access (ZTNA): Configured with zero-trust enable (applicable only to Secure FTD Software).
• Exploitation Status: Cisco's Product Security Incident Response Team (PSIRT) became aware of active exploitation of this vulnerability in August 2026. This confirms that threat actors are already leveraging this flaw in real-world attacks.

Technical Details & Attack Vector¶

The attack vector for CVE-2026-20349 is straightforward, making it highly attractive to adversaries due to its low complexity and unauthenticated nature. An attacker can send a crafted HTTP request directly to the internet-facing Remote Access SSL VPN service. Because these services are often intentionally exposed to the internet, no prior compromise of an internal host or acquisition of credentials is required.

There is currently no public Proof-of-Concept (PoC) exploit script identified in Cisco's advisory or related reports. However, the confirmed in-the-wild exploitation indicates that threat actors have developed and are actively using working exploits.

Conceptual Attack Flow:

1. Target Identification: Attacker scans for internet-exposed Cisco ASA/FTD devices with enabled Remote Access SSL VPN, IKEv2 client services, or ZTNA.
2. Crafted Request: Attacker sends a specially malformed or unexpected HTTP request to the vulnerable service.
3. DoS Trigger: The AFD.sys or related network processing component encounters an error due to insufficient input validation or error handling, leading to a critical system fault.
4. Device Reload: The ASA/FTD device crashes and reloads, resulting in a temporary but disruptive denial of service.

Repeatedly sending such requests can lead to prolonged outages and significant operational impact.

Detection & Hunting Playbook¶

Organizations should implement a robust detection strategy for CVE-2026-20349:

• Unexpected Device Reloads: Monitor Cisco ASA/FTD device logs for unexpected reloads, crashes, or uninitiated restarts that do not correspond to planned maintenance or administrative actions. These are primary indicators of exploitation.
• VPN Session Interruptions: Look for a sudden increase in VPN session terminations or connection failures that align with device reloads.
• HTTP Request Anomalies: Analyze HTTP traffic targeting ASA/FTD VPN interfaces for malformed requests, unusual patterns, or requests that trigger error conditions. Focus on traffic to /+CSCOE+/ or other VPN-related paths.
• System Health Monitoring: Implement continuous monitoring of firewall health, uptime, and resource utilization. Sudden drops in availability or unusual resource spikes preceding reloads could be indicative.
• Cisco Logs: Scrutinize Cisco system logs (show logging) for messages indicating errors in the SSL VPN component, HTTP parsing failures, or system crashes.
• Configuration Review: Regularly audit ASA/FTD configurations (show running-config) to confirm that Remote Access SSL VPN, IKEv2 client services, or Zero Trust Network Access are enabled on internet-facing interfaces, as these are prerequisites for vulnerability.
• No PoC-Specific IOCs: Given the lack of public PoCs or specific IOCs, behavioral monitoring and anomaly detection are paramount over signature-based approaches.

Mitigation & Remediation (Priority-Ordered)¶

Cisco has stated that there are no effective workarounds that fully address CVE-2026-20349. Therefore, immediate patching is the only complete remediation.

1. Apply Hotfixes/Upgrade Software Immediately:
   • Organizations must apply the vendor-provided hotfixes or upgrade to a fixed software release as soon as possible. Refer to Cisco's official security advisory (cisco-sa-asaftd-vpn-dos-dzv4mQFF) for precise hotfix versions and installation instructions for both ASA and FTD software branches.
   • Cisco Secure Firewall ASA Hot Fixes examples: 89.16.4.50 (for ASA 9.16), 9.20.4.235 (for ASA 9.20), etc.
   • Cisco Secure FTD Hot Fixes examples: Cisco_FTD_Hotfix_GC-7.0.9.1-1.sh.REL.tar (for FTD 7.0), Cisco_FTD_Hotfix_DD-7.6.4.1-2.sh.REL.tar (for FTD 7.6), etc.
   • Important: For ASA 9.16/9.18 hotfixes starting with 89.x, use ASDM Release 7.24.1.374 or later.
2. Identify and Prioritize Exposed Devices: Use Cisco's Software Checker tool to identify all ASA/FTD appliances running vulnerable software versions with the affected remote-access configurations. Prioritize patching these internet-exposed devices.
3. Review Network Architecture: Ensure that ASA/FTD devices are part of a robust defense-in-depth strategy. While patching is key, good network hygiene and segmentation can limit the blast radius of any successful attack.
4. Incident Response Preparedness: Have an incident response plan in place for DoS attacks, including procedures for restoring critical services and analyzing device logs post-outage.

Conclusion¶

The active exploitation of CVE-2026-20349 underscores the constant threat to internet-facing network infrastructure. Given that no workarounds exist, immediate application of Cisco's provided hotfixes or software upgrades is paramount to protect against disruptive denial-of-service attacks targeting Cisco ASA and FTD Remote Access SSL VPN services. Vigilant monitoring for unexpected reloads and VPN interruptions is also critical for early detection of exploitation attempts.