Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2026-20349

HighExploitedPublic exploit

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting…

Published Aug 11, 2026 · Updated Sep 16, 2026

Key Facts

Patch immediately
  • CVE-2026-20349 is a high-severity vulnerability (CVSS 8.6 v3.1) affecting Secure Firewall Threat Defense (Cisco), Adaptive Security Appliance Software (Cisco), Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and 1 more product.
  • It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Aug 11, 2026. Public exploit code is available.
  • EPSS estimates a 1.0% probability of exploitation in the next 30 days.
  • No fixed version is listed yet; check the vendor advisory for mitigations.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

8.6

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

EPSS (30-day exploit likelihood)

1.0%

Higher than 62.5% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2026-20349 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CISA KEVAug 11, 2026Aug 14, 2026Not reported
Industry KEV feedAug 11, 2026Aug 14, 2026Not reported
CIRCL KEVAug 11, 2026Aug 14, 2026Not reported
ENISA EUVDAug 11, 2026n/aNot reported

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Products

199 affected entries in total
ProductAffected versionsFixed in
Secure Firewall Threat DefenseCisco10.0.0, 10.0.2, 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.0.2.1n/a
Adaptive Security Appliance SoftwareCisco9.16.1, 9.16.1.28, 9.16.2, 9.16.2.11, 9.16.2.13, 9.16.2.14, 9.16.2.3, 9.16.2.7n/a
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software>= 9.16.1n/a
Cisco Secure Firewall Threat Defense (FTD) Software>= 7.0.0n/a

Timeline

  1. Publicly disclosed

    Aug 11, 2026

  2. Added to CISA KEV

    Aug 11, 2026

  3. Added to Industry KEV feed

    Aug 11, 2026

  4. Added to CIRCL KEV

    Aug 11, 2026

  5. Added to ENISA EUVD

    Aug 11, 2026

  6. Last updated

    Sep 16, 2026

Weakness Type

  • CWE-244 Improper Clearing of Heap Memory Before Release ('Heap Inspection')

References

3 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2026-20349 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo