Cisco ASA/FTD CVE-2026-20349: Unauthenticated SSL VPN HTTP Request Reloads the Firewall — Exploited in August

Introduction

Cisco published CVE-2026-20349 on August 11: insufficient error checking in Remote Access SSL VPN HTTP handling on Secure Firewall ASA and FTD. An unauthenticated attacker sends a crafted request to the VPN service and the box reloads — a denial of service you can repeat. CVSS 8.6 with changed scope. There is no workaround. Cisco PSIRT said it became aware of active exploitation in August and told customers to upgrade. CISA added the CVE to KEV the same day (catalogued as a heap-inspection issue on ASA/FTD). If AnyConnect / SSL VPN is on, this is an availability bug on the same appliances this site already covered for FIRESTARTER persistence.

What Happened

The vulnerable condition is: ASA or FTD on an affected release and Remote Access SSL VPN enabled (the advisory's "vulnerable configurations" table). A crafted HTTP request to that service skips proper error checking and takes the device down via reload. That is a network-outage primitive against the edge, not a quiet info leak.

First fixed ASA trains per cisco-sa-asaftd-vpn-dos-dzv4mQFF:

FTD / FMC:

Cisco later pointed customers at security-hardening releases in advisory updates. Prefer the newest hardening build on your train once you are at or above those floors.

CISA's August 11 three-CVE drop also included the Lazarus afd.sys bug and Metabase SQLi — three different estates, one KEV day.

Why It Matters

A reload loop on the SSL VPN concentrator is a business outage and a cover for something noisier. Operators who still have lingering FIRESTARTER / ED 25-03 work know these boxes are already a hostile neighborhood. Unauthenticated DoS on the same listener as your remote workforce is how you take the workforce offline without a botnet.

Who Is Affected

• ASA 9.16–9.24 below the first-fixed releases above, with RA SSL VPN configured
• FTD 7.0–7.7 and 10.x below the listed builds, same VPN config
• Internet-facing AnyConnect / SSL VPN headends — default assumption
• Appliances without SSL VPN — not in the vulnerable-config table for this CVE; still patch on cadence

How to Protect Yourself

1. Confirm SSL VPN is on, then upgrade. There is no ACL that fixes the parser.

ciscoasa# show version
ciscoasa# show webvpn
ciscoasa# show running-config webvpn

On FTD, use show version in CLISH / FMC inventory and match the table. Schedule the reload you choose rather than the one the attacker chooses.

2. Until the code is current, reduce who can hit the VPN listener — known-user IP ranges, MFA still required for legitimate sessions, but understand that this CVE does not need a login. Geo or partner allow-lists cut opportunistic reload spam; they do not replace the image.

3. Hunt unexpected reloads.

ciscoasa# show crashinfo
ciscoasa# show logging | include reload|SSL|webvpn

Correlate VPN-interface unreachability with inbound HTTP to the WebVPN portal from IPs that never completed a tunnel. Off-box syslog is mandatory; a crashing box will not keep the story.

4. Do not treat "only a DoS" as skippable. After you land the fixed image, stay on Cisco's hardening releases and keep the FIRESTARTER / core-dump hunts from ED 25-03 in the same change program. These are the same CPUs.

Source

• Cisco — ASA/FTD Remote Access SSL VPN DoS (cisco-sa-asaftd-vpn-dos-dzv4mQFF)
• CISA — Adds Three Known Exploited Vulnerabilities (11 Aug 2026)
• CVE — CVE-2026-20349