What Cisco disclosed
Cisco has confirmed a denial-of-service (DoS) vulnerability, tracked as CVE-2026-20349, in the Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software that runs a large share of enterprise remote-access virtual private network (VPN) gateways. The advisory went out on August 11, 2026, and Cisco's Product Security Incident Response Team (PSIRT) says the flaw is already being used in real-world attacks. Days later, the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog and set an August 14 remediation deadline for federal civilian agencies.
No login needed
The bug carries a Common Vulnerability Scoring System (CVSS) severity rating of 8.6 out of 10. It lives in how ASA and FTD parse incoming HTTP requests to the Remote Access SSL VPN (Secure Sockets Layer virtual private network) service: insufficient error handling there means a single crafted, unauthenticated request is enough to make the device reload. Cisco classifies this strictly as a denial-of-service issue rather than one that hands an attacker code execution or data access. That distinction matters for severity scoring, but it doesn't make the bug harmless - a firewall that keeps restarting is also a firewall that keeps dropping remote workers' connections, and nothing stops an attacker from sending the request again.
Which devices are exposed
The flaw only triggers on appliances where one of three features is switched on: SSL VPN, IKEv2 (Internet Key Exchange version 2) remote-access VPN with client services, or Zero Trust Network Access (ZTNA). A firewall used purely for site-to-site VPN, or with remote access turned off entirely, isn't exposed.
Where those features are enabled, the affected list is wide:
| Product | Vulnerable release trains |
|---|---|
| ASA (Adaptive Security Appliance) | 9.16, 9.18, 9.20, 9.22, 9.23, 9.24 |
| FTD (Threat Defense) | 7.0, 7.2, 7.4, 7.6, 7.7, 10.0 |
That covers essentially every currently supported branch of both product lines - not a narrow edge case.
How it surfaced
Cisco says its own internal testing found the bug, and security researcher Valerio Brussani reported it independently around the same time. The company has not published indicators of compromise, so there's no public signature defenders can hunt for yet. PSIRT's confirmation of active exploitation is, for now, the extent of the public detail on what attacks against this flaw actually look like.
The only fix is the hotfix
There's no interim configuration change that closes this off. Cisco's advisory points administrators to hotfixed builds for each affected train - for example ASA 9.24.1.221 and FTD 7.7.11.1-2 - and running an unpatched build with remote access enabled leaves the crash path open regardless of other firewall hardening.
Checking exposure before the hotfix lands
For teams that can't push the hotfix the same day, a few checks narrow down actual risk quickly:
- Confirm whether
webvpn(the SSL VPN service) is enabled on the device's running configuration. - Check whether IKEv2 remote-access VPN with client services, or ZTNA, is configured, since either also triggers the flaw independent of SSL VPN.
- Cross-reference the device's software train against the affected list above - a device on an unlisted train, or one running strictly as a site-to-site VPN endpoint, is not vulnerable to this specific bug.
- Treat any unexpected ASA or FTD reload in the affected window as worth investigating, even without published indicators of compromise, since a crash is the visible symptom this bug produces.
None of these substitute for the hotfix. They're a way to triage which devices need attention first when a fleet can't all be patched in the same maintenance window.
What it means in practice
If an organization runs ASA or FTD with SSL VPN, IKEv2 remote access, or ZTNA turned on, patching this is not routine maintenance to schedule for later - Cisco has already confirmed exploitation, and a denial-of-service hit on a remote-access gateway can cut off VPN connectivity for an entire remote workforce with one request. CISA's August 14 deadline applied to US federal civilian agencies specifically, but the underlying risk doesn't stop at that boundary. Administrators who can't apply the hotfix immediately should at minimum check which of the three trigger features - SSL VPN, IKEv2 remote access, or ZTNA - are actually in use on their devices, since disabling an unused one narrows the exposure until the update goes in. Edge devices like these sit at the network perimeter, which is exactly where attackers look first, and exactly why an unauthenticated, no-interaction crash bug in one is worth acting on the same week it's disclosed.
