A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance

CVE-2026-20349 is an unauthenticated denial-of-service vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall ASA (versions 9.16 through 9.24) and FTD (versions 7.0 through 10.0). A crafted HTTP request sent to the SSL VPN listener causes insufficient error checking during processing, triggering a full device reload. The attack requires no credentials, no user interaction, and works against any device with SSL VPN, IKEv2 RA VPN with client services, or Zero Trust Network Access enabled. The root cause is classified as CWE-244 (Improper Clearing of Heap Data) — the device mishandles heap state during HTTP parsing, leading to a crash.

Cisco rated this HIGH at 8.6 and that score is accurate. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) correctly captures the zero-friction remote DoS with changed scope — a single packet can take out VPN access for an entire site. The vendor score is not inflated: the attack is trivial to execute, requires no auth, has no workaround, and is confirmed exploited in the wild. The only reason this isn't CRITICAL is the impact ceiling — it's availability-only with no path to code execution or data compromise.

Why this verdict

• Active exploitation + KEV listing: CISA added this on 2026-08-11 with an unusually aggressive 3-day federal remediation deadline, confirming real-world attacks are occurring now.
• Zero friction to exploit: Unauthenticated, no user interaction, low complexity, network-reachable. The attack surface is the SSL VPN listener — which by definition faces the internet. There is no prerequisite that narrows the reachable population.
• No workaround available: Cisco offers no mitigation short of patching. You cannot disable SSL VPN without breaking remote access. Rate limiting or ACLs on the VPN port would block legitimate users.
• Role multiplier: Cisco ASA/FTD is canonically a network edge appliance — it IS the perimeter firewall and VPN concentrator. ≥90% of ASA/FTD deployments occupy this high-value role by definition. However, the chain outcome is availability loss (device reload), NOT domain takeover, fleet compromise, or data exfil. DoS on a VPN concentrator is operationally severe but does not cross the CRITICAL blast-radius threshold of 'fleet compromise / mass data egress / supply-chain pivot.' The floor for this role + outcome combination is HIGH, which matches the vendor score.
• Broad version coverage: Every currently supported ASA (9.16–9.24) and FTD (7.0–10.0) release train is affected. This is not a narrow edge case — it hits the entire installed base running RA VPN.

Why not higher?

The impact is strictly availability-only — the device reloads but there is no code execution, no memory disclosure, no integrity violation, and no path to lateral movement. A CRITICAL rating requires confidentiality or integrity impact, or a DoS that leads to safety/OT consequences. A VPN concentrator reload is operationally painful but recoverable, and HA pairs (when present) limit blast radius to minutes of downtime per crash.

Why not lower?

This cannot be MEDIUM because: (1) it is actively exploited in the wild with KEV confirmation, (2) the attack requires zero authentication against an internet-facing service, (3) no workaround exists, and (4) the affected component is the perimeter firewall itself — not an internal application with limited exposure. Every friction-reducing factor that would normally justify a downgrade is absent here.

1. Apply vendor hotfix immediately — This is the only remediation. No workaround exists. Per noisgate guidance for KEV-listed vulnerabilities: patch within hours, not days. Prioritize internet-facing HA pairs — patch standby first, failover, then patch the former primary.
2. Enable crash-loop detection and alerting — Configure syslog forwarding for %ASA-1-199001 (crash) and %ASA-6-199002 (reload) events. Set NMS polling to 30-second intervals on VPN concentrators. Deploy within the noisgate mitigation SLA of 3 days for HIGH severity, though KEV status demands faster action.
3. Rate-limit new TCP connections to VPN listener — If patching requires a maintenance window, apply connection-rate-limit on the outside interface for port 443/8443 via threat-detection scanning-threat or upstream ACL on the ISP edge. This won't block the attack but raises the bar for sustained crash-loop attacks. This is a *temporary* measure only.
4. Validate HA failover behavior — Confirm that your HA pair correctly fails over on crash and that the standby unit is also scheduled for patching. Test failover manually before the patch window to ensure it works under pressure.

Run this script from any host with SSH access to the ASA/FTD management interface. It connects via SSH, extracts the running software version, and compares it against known fixed versions. Requires ssh and awk. Usage: bash check_cve_2026_20349.sh <asa-mgmt-ip> <username>

#!/usr/bin/env bash
# check_cve_2026_20349.sh — Verify Cisco ASA/FTD patch status for CVE-2026-20349
# Usage: bash check_cve_2026_20349.sh <host> <username>
# Requires: SSH access to ASA/FTD management interface

set -euo pipefail

HOST="${1:?Usage: $0 <host> <username>}"
USER="${2:?Usage: $0 <host> <username>}"

echo "[*] Connecting to $HOST as $USER..."
VERSION_OUTPUT=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$USER@$HOST" 'show version | include Software Version' 2>/dev/null) || {
  echo "UNKNOWN — SSH connection failed to $HOST"
  exit 2
}

# Extract version number (e.g., 9.18.4.34)
VER=$(echo "$VERSION_OUTPUT" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+)?' | head -1)

if [ -z "$VER" ]; then
  echo "UNKNOWN — could not parse version from output: $VERSION_OUTPUT"
  exit 2
fi

echo "[*] Detected version: $VER"

# Check if RA VPN is enabled
VPN_CHECK=$(ssh -o ConnectTimeout=10 "$USER@$HOST" 'show running-config webvpn | include enable' 2>/dev/null || true)
IKEV2_CHECK=$(ssh -o ConnectTimeout=10 "$USER@$HOST" 'show running-config crypto ikev2 | include client-services' 2>/dev/null || true)

if [ -z "$VPN_CHECK" ] && [ -z "$IKEV2_CHECK" ]; then
  echo "PATCHED — No SSL VPN or IKEv2 RA VPN with client-services enabled (not vulnerable configuration)"
  exit 0
fi

echo "[*] Remote Access VPN is enabled — checking version against fixed releases..."

# Fixed versions per Cisco advisory
# ASA: 9.16.4.50, 9.18.4.50, 9.20.4.235, 9.22.3.191, 9.23.1.211, 9.24.1.221
# Compare using sort -V
version_gte() {
  [ "$(printf '%s\n%s' "$1" "$2" | sort -V | tail -1)" = "$1" ]
}

case "$VER" in
  9.16.*)
    if version_gte "$VER" "9.16.4.50"; then echo "PATCHED — $VER >= 9.16.4.50"; exit 0
    else echo "VULNERABLE — $VER < 9.16.4.50"; exit 1; fi ;;
  9.18.*)
    if version_gte "$VER" "9.18.4.50"; then echo "PATCHED — $VER >= 9.18.4.50"; exit 0
    else echo "VULNERABLE — $VER < 9.18.4.50"; exit 1; fi ;;
  9.20.*)
    if version_gte "$VER" "9.20.4.235"; then echo "PATCHED — $VER >= 9.20.4.235"; exit 0
    else echo "VULNERABLE — $VER < 9.20.4.235"; exit 1; fi ;;
  9.22.*)
    if version_gte "$VER" "9.22.3.191"; then echo "PATCHED — $VER >= 9.22.3.191"; exit 0
    else echo "VULNERABLE — $VER < 9.22.3.191"; exit 1; fi ;;
  9.23.*)
    if version_gte "$VER" "9.23.1.211"; then echo "PATCHED — $VER >= 9.23.1.211"; exit 0
    else echo "VULNERABLE — $VER < 9.23.1.211"; exit 1; fi ;;
  9.24.*)
    if version_gte "$VER" "9.24.1.221"; then echo "PATCHED — $VER >= 9.24.1.221"; exit 0
    else echo "VULNERABLE — $VER < 9.24.1.221"; exit 1; fi ;;
  *)
    echo "UNKNOWN — version $VER not in known affected range (may be FTD or unsupported train)"
    exit 2 ;;
esac

Sources

1. Cisco Security Advisory (cisco-sa-asaftd-vpn-m9sx6MbC)
2. CISA KEV Addition Alert (2026-08-11)
3. BleepingComputer — Cisco warns of ASA and FTD VPN flaw exploited to crash devices
4. The Hacker News — Cisco ASA and FTD Flaw Exploited in the Wild
5. KEV Intelligence — CVE-2026-20349
6. Vulnerability-Lookup — CVE-2026-20349
7. Eclypsium — Cisco ASA Scanning Surge