Cisco is warning that a high-severity denial-of-service vulnerability in Secure Firewall ASA and Threat Defense (FTD) software is being actively exploited in attacks to remotely crash affected devices.
The flaw, tracked as CVE-2026-20349, has a severity score of 8.6 and impacts devices running Cisco Secure Firewall Adaptive Security Appliance (ASA) or Secure Firewall Threat Defense (FTD) software with certain remote access services enabled.
In a security advisory published today, Cisco said the vulnerability is caused by insufficient error checking while processing HTTP requests.
“An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device,” Cisco explains in the advisory.
“A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.”
The vulnerability can be exploited remotely without authentication or user interaction when SSL listen sockets are enabled.
Vulnerable configurations include IKEv2 Remote Access VPN with client services, SSL VPN, and Zero Trust Network Access on FTD devices. Cisco says Secure Firewall Management Center (FMC) software is not affected.
There are no workarounds for the vulnerability, and Cisco strongly recommends that customers upgrade to a fixed software release to fully remediate the issue.
Cisco’s PSIRT says it became aware of active exploitation of CVE-2026-20349 in August 2026, but the company has not shared additional information about the attacks, including who is exploiting the vulnerability or what organizations are being targeted.
The vulnerability was also discovered during Cisco’s internal security testing and independently reported to the company by security researcher Valerio Brussani.
Cisco’s advisory does not provide indicators of compromise associated with the ongoing exploitation.
The company also disclosed this month that Secure Endpoint Connector for Windows, Mac, and Linux is vulnerable to ClamAV vulnerabilities with public exploits.
However, the patches are not available yet and will be released later this month.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Cisco warns of high-severity ClamAV flaws with public exploits
Cisco warns of FMC static credential flaw exploited in zero-day attacks
CISA sets urgent deadline to fix Cisco flaw exploited in attacks
Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks
Critical Progress LoadMaster flaw now actively exploited in attacks
LexisNexis shuts down services after suspicious activity on servers
Valve notifies Steam hardware customers of a data breach
Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days
See how Skyhigh Security’s patent-pending approach secures every browser session without costly and clunky enterprise browser replacements.
Overdue a password health-check? Audit your Active Directory for free
Pixellot discovered and secured hundreds of unmanaged AI agent identities in weeks, not months. Download the case study for how.
Webinar: Shadow AI in 2026 (and how attackers are taking advantage)
See how real inboxes, fake stores and AI scams shaped H1 2026 cyber threats
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
