{"id":"cisco-asa-ftd-vpn-crashes-aug-2026","category":"patch","status":"closed","title":"Cisco ASA and FTD VPN crash flaw CVE-2026-20349 used in attacks; fixes available","tldr":"Attackers are exploiting CVE-2026-20349 to restart Cisco ASA and FTD business firewalls without logging in. Organisations using affected remote-access services should install Cisco's September hardening release for their branch.","summary":"CVE-2026-20349 affects the remote-access SSL VPN service in Cisco ASA and FTD business firewalls. An attacker without a login can cause an unexpected restart, interrupting service. Exposure depends on the software release and configuration: SSL VPN, IKEv2 remote-access VPN with client services, or FTD's Zero Trust Network Access can enable the affected service. Cisco Firewall Management Center is unaffected. Cisco disclosed the flaw on 11 August and confirmed active exploitation; CISA listed it that day. Earlier hot fixes were followed by published September hardening releases covering the listed branches. There is no workaround. The reviewed reports do not identify attackers or victims, and do not establish whether attacks have since stopped.","action":"If your workplace or family office uses Cisco ASA or FTD, ask its IT provider to check the exact build with Cisco Software Checker and install the recommended hardening release listed below. Ask them to review firewall and VPN logs for unexplained restarts and service interruptions.","product":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-20349"],"tags":["cisco","asa","ftd","firewall","vpn","denial-of-service","actively-exploited"],"affected":["Cisco Secure Firewall ASA Software: vulnerable releases in 9.16 and earlier, 9.18, 9.20, 9.22, 9.23 and 9.24.","Cisco Secure FTD Software: vulnerable releases in 7.0 and earlier, 7.2, 7.4, 7.6, 7.7 and 10.0.","An affected release must also have SSL VPN, IKEv2 Remote Access VPN with client services, or Zero Trust Network Access (FTD only) enabled."],"fixed":["ASA 9.16 and earlier: 9.16.4.103","ASA 9.18: 9.18.4.94","ASA 9.20: 9.20.4.49","ASA 9.22: 9.22.3.26","ASA 9.23: 9.23.1.47","ASA 9.24: 9.24.1.26","FTD 7.0 and earlier: 7.0.10","FTD 7.2: 7.2.12","FTD 7.4: 7.4.8","FTD 7.6: 7.6.6","FTD 7.7: 7.7.13","FTD 10.0: 10.0.2","FTD 10.1: 10.1.0"],"matches":[],"sources":[{"kind":"advisory","title":"Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF","by":"Cisco","date":"2026-09-16"},{"kind":"advisory","title":"Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software Hardening Release: September 2026","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN","by":"Cisco","date":"2026-09-18"},{"kind":"news","title":"Cisco warns of ASA and FTD VPN flaw exploited to crash devices","url":"https://www.bleepingcomputer.com/news/security/cisco-warns-of-asa-and-ftd-vpn-flaw-exploited-to-crash-devices/","by":"BleepingComputer","date":"2026-08-11"},{"kind":"advisory","title":"AL26-018: Vulnerability affecting Cisco ASA and Secure Firewall Threat Defense Software Remote Access SSL VPN","url":"https://www.cyber.gc.ca/en/alerts-advisories/al26-018-vulnerability-affecting-cisco-asa-secure-firewall-threat-defense-software-remote-access-ssl-vpn-cve-2026-20349","by":"Canadian Centre for Cyber Security","date":"2026-08-13"},{"kind":"advisory","title":"Cisco security advisory (AV26-807)","url":"https://www.cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-807","by":"Canadian Centre for Cyber Security","date":"2026-08-12"}],"started":"2026-08-11","closed":"2026-09-18","created":"2026-11-03T22:15:13.547Z","updated":"2026-11-03T22:15:13.547Z","cve_notes":[{"cve":"CVE-2026-20349","name":"Remote-access SSL VPN crash flaw in Cisco ASA and FTD","what":"Insufficient error checking in Cisco ASA and FTD's remote-access SSL VPN service lets an attacker without a login force the firewall to restart and interrupt service.","severity":"high","cvss":8.6}],"timeline":[{"at":"2026-09-18T15:50Z","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Cisco revised the ASA fixed-release table in its accompanying hardening advisory. It continued to recommend the hardening releases, including for customers who had installed earlier hot fixes.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN","by":"Cisco","patch":null},{"at":"2026-09-16T16:05Z","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Cisco replaced its earlier hot-fix guidance with published hardening releases containing this fix and other security improvements. Fixes were listed for every release branch in the advisory.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF","by":"Cisco","patch":"patched"},{"at":"2026-08-11T16:39Z","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Cisco disclosed CVE-2026-20349 and confirmed exploitation during August. The flaw lets an attacker without a login force affected ASA and FTD firewalls to restart; hot fixes were available.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF","by":"Cisco","patch":null},{"at":"2026-08-11","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-20349 to its Known Exploited Vulnerabilities catalogue, according to the Canadian Centre for Cyber Security's subsequent notice.","url":"https://www.cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-807","by":"Canadian Centre for Cyber Security","patch":null}],"url":"https://hard.fyi/live/cisco-asa-ftd-vpn-crashes-aug-2026/","json":"https://hard.fyi/api/live?id=cisco-asa-ftd-vpn-crashes-aug-2026"}