Cisco has warned that a new vulnerability impacting Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software has been exploited in the wild.
The high-severity flaw, tracked as CVE-2026-20349 (CVSS score: 8.6), is a case of insufficient error checking when processing HTTP requests that could allow an unauthenticated, remote attacker to trigger a denial-of-service (DoS) condition.
“An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device,” Cisco said in a Tuesday advisory. “A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.”
The security defects impact devices running a vulnerable version of Secure Firewall ASA Software or Cisco Secure FTD Software and have one or more of the vulnerable configurations listed below –
- IKEv2 Remote Access VPN (with client services) – crypto ikev2 enable <interface_name> client-services port <port_numbers>
- SSL-VPN – webvpn enable <interface_name>
- Zero Trust Network Access2 – zero-trust enable
The following versions of ASA and FTD are affected –
- ASA 9.161 – Fixed in 89.16.4.50)
- ASA 9.181 – Fixed in 89.18.4.50)
- ASA 9.20 – Fixed in 9.20.4.235)
- ASA 9.22 – Fixed in 9.22.3.191)
- ASA 9.23 – Fixed in 9.23.1.211)
- ASA 9.24 – Fixed in 9.24.1.221)
-
FTD 7.0 – Fixed in
- Cisco_FTD_Hotfix_GC-7.0.9.1-1.sh.REL.tar
- Cisco_FTD_SSP_FP1K_Hotfix_GC-7.0.9.1-1.sh.REL.tar
- Cisco_FTD_SSP_FP2K_Hotfix_GC-7.0.9.1-1.sh.REL.tar
- Cisco_FTD_SSP_Hotfix_GC-7.0.9.1-1.sh.REL.tar
-
FTD 7.2 – Fixed in
- Cisco_FTD_Hotfix_HM-7.2.11.1-2.sh.REL.tar
- Cisco_FTD_SSP_FP1K_Hotfix_HM-7.2.11.1-2.sh.REL.tar
- Cisco_FTD_SSP_FP2K_Hotfix_HM-7.2.11.1-2.sh.REL.tar
- Cisco_FTD_SSP_FP3K_Hotfix_HM-7.2.11.1-2.sh.REL.tar
- Cisco_FTD_SSP_Hotfix_HM-7.2.11.1-2.sh.REL.tar
-
FTD 7.4 – Fixed in
- Cisco_FTD_Hotfix_HK-7.4.7.1-1.sh.REL.tar
- Cisco_FTD_SSP_FP1K_Hotfix_HK-7.4.7.1-1.sh.REL.tar
- Cisco_FTD_SSP_FP2K_Hotfix_HK-7.4.7.1-1.sh.REL.tar
- Cisco_FTD_SSP_FP3K_Hotfix_HK-7.4.7.1-1.sh.REL.tar
- Cisco_FTD_SSP_Hotfix_HK-7.4.7.1-1.sh.REL.tar
- Cisco_Secure_FW_TD_4200_Hotfix_HK-7.4.7.1-1.sh.REL.tar
-
FTD 7.6 (Fixed in
- Cisco_FTD_Hotfix_DD-7.6.4.1-2.sh.REL.tar
- Cisco_FTD_SSP_FP1K_Hotfix_DD-7.6.4.1-2.sh.REL.tar
- Cisco_FTD_SSP_FP3K_Hotfix_DD-7.6.4.1-2.sh.REL.tar
- Cisco_FTD_SSP_Hotfix_DD-7.6.4.1-2.sh.REL.tar
- Cisco_Secure_FW_TD_4200_Hotfix_DD-7.6.4.1-2.sh.REL.tar
-
FTD 7.7 – Fixed in
- Cisco_FTD_Hotfix_AN-7.7.11.1-2.sh.REL.tar
- Cisco_FTD_SSP_FP1K_Hotfix_AN-7.7.11.1-2.sh.REL.tar
- Cisco_FTD_SSP_FP3K_Hotfix_AN-7.7.11.1-2.sh.REL.tar
- Cisco_FTD_SSP_Hotfix_AN-7.7.11.1-2.sh.REL.tar
- Cisco_Secure_FW_TD_1200_Hotfix_AN-7.7.11.1-2.sh.REL.tar
- Cisco_Secure_FW_TD_4200_Hotfix_AN-7.7.11.1-2.sh.REL.tar
-
FTD 10.0 – Fixed in
- Cisco_FTD_Hotfix_S-10.0.0.1-2.sh.REL.tar
- Cisco_FTD_SSP_FP1K_Hotfix_S-10.0.0.1-2.sh.REL.tar
- Cisco_FTD_SSP_FP3K_Hotfix_S-10.0.0.1-2.sh.REL.tar
- Cisco_FTD_SSP_Hotfix_S-10.0.0.1-2.sh.REL.tar
- Cisco_Secure_FW_TD_200_Hotfix_R-10.0.0.1-2.sh.REL.tar
- Cisco_Secure_FW_TD_1200_Hotfix_S-10.0.0.1-2.sh.REL.tar
- Cisco_Secure_FW_TD_4200_Hotfix_S-10.0.0.1-2.sh.REL.tar
- Cisco_Secure_FW_TD_6100_Hotfix_S-10.0.0.1-2.sh.REL.tar
Cisco said there are no workarounds that address the flaw, adding it became aware of active exploitation earlier this month. The network equipment maker said the issue was found during internal security testing. It also credited Valerio Brussani for separately discovering and reporting the vulnerability.
There are currently no details about the nature of the attacks, the identity and origins of the threat actor exploiting the vulnerability, what organizations have been targeted, and if any of those efforts were successful.
The development has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add the flaw to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by August 14, 2026.
