CVE-2026-20349: Cisco Urges Immediate Patching of Actively Exploited ASA and FTD DoS Vulnerability

• Root cause: Insufficient error checking when the Remote Access SSL VPN service processes HTTP requests .
• Attack vector: An unauthenticated, remote attacker sends a single crafted HTTP request to the affected device .
• Effect: The exploit forces an unexpected device reload, creating a denial-of-service (DoS) condition that severs VPN access for all remote users and disrupts related network services .

No user interaction or authentication is required for exploitation. Cisco's Product Security Incident Response Team (PSIRT) became aware of active exploitation in August 2026 .

Remediation: Patch Immediately, No Workarounds

Cisco has released hot fixes covering the affected software trains. There are no configuration workarounds — patching is the sole mitigation .

• ASA Software: Versions 9.16 through 9.24
• FTD Software: Versions 7.0 through 10.0

All devices running these versions with Remote Access SSL VPN, SSL VPN, IKEv2 Remote Access VPN with client services, or Zero Trust Network Access enabled are considered in scope .

CISA Response and Federal Deadline

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-20349 to its Known Exploited Vulnerabilities (KEV) catalog . Under this directive, all U.S. Federal Civilian Executive Branch (FCEB) agencies are required to remediate the vulnerability by August 14, 2026 .

Broader Security Context: A Tough Period for Cisco Firewall Defenders

This disclosure arrives amid an especially turbulent period for Cisco firewall appliances and the broader attack surface.

September 2025: CISA Emergency Directive ED 25-03

In September 2025, CISA issued Emergency Directive 25-03 after an advanced threat actor campaign exploited zero-day vulnerabilities (CVE-2025-20333, CVE-2025-20362) in Cisco ASA and Firepower devices. The campaign had already compromised at least 10 organizations and left nearly 50,000 devices potentially vulnerable . The directive mandated federal agencies to identify and mitigate compromised Cisco devices within 24 hours .

March 2026: The LiteLLM Supply-Chain Attack

Threat actor group TeamPCP compromised the open-source LiteLLM AI API gateway, potentially exposing over 2,500 organizations (including Cisco) and roughly 434,000 CI/CD pipelines in what CloudSEK called the largest AI supply-chain breach of 2026 . Attackers exfiltrated approximately 195 terabytes of credential data within a 40-minute window . CloudSEK's high-confidence victim list included NVIDIA, Amazon Web Services, Samsung Electronics, Cisco Systems, Siemens, ServiceNow, and many others .

Why This Matters Now

Cisco's ASA and FTD products have been a recurring target for sophisticated attackers. This latest actively exploited DoS flaw adds pressure on defenders who are still dealing with the fallout from both the 2025 campaign and the LiteLLM supply-chain exposure. The vulnerability sits on the Internet-facing security boundary, requires no authentication, and can be triggered with a single request — making it a high-priority, immediate-patch situation for any organization running affected Cisco firewall software .