en

CVE-2026-20349: Cisco ASA and FTD's Actively Exploited VPN Denial-of-Service Flaw

Technical breakdown of the actively exploited remote unauthenticated VPN denial-of-service vulnerability in Cisco ASA and FTD firewalls.

James Luther

James Luther

— 2 min read
CVE-2026-20349: Cisco ASA and FTD's Actively Exploited VPN Denial-of-Service Flaw
Photo by Albert Stoynov / Unsplash
📌
Security Roundup Series: Week of August 10, 2026 • 4 min read deep dive

Cisco has confirmed active, in-the-wild exploitation of a vulnerability in its Secure Firewall ASA and FTD software that allows unauthenticated remote attackers to repeatedly crash VPN heads and trigger widespread service outages.

🚨
Vulnerability Intelligence: CVE ID: CVE-2026-20349 (CWE-399: Resource Management Error) Severity: High (CVSS 8.6 — Unauthenticated Remote DoS) Exploitation Status: ⚠️ Actively Exploited in the Wild (Confirmed by Cisco PSIRT) Target Services: IKEv2 Remote Access VPN, AnyConnect SSL VPN, and ZTNA Fixed Releases: Cisco ASA / FTD August 2026 Advisory Releases

What's Affected

The vulnerability impacts Cisco Secure Firewall Adaptive Security Appliance (ASA) software releases 9.16, 9.18, 9.20, 9.22, 9.23, and 9.24, as well as Secure Firewall Threat Defense (FTD) releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0.

Appliances are vulnerable when configured with IKEv2 Remote Access VPN with client services enabled, SSL VPN (AnyConnect), or Zero Trust Network Access (ZTNA) application gateway services.

The Vulnerability

CVE-2026-20349 is an unauthenticated memory-corruption and resource-exhaustion flaw in the VPN packet processing engine. By transmitting specially crafted negotiation sequences to an exposed VPN gateway interface, an attacker causes the packet processing core to crash, forcing a full appliance reload and dropping all active VPN tunnels.

Attack Chain Breakdown

  1. Unauthenticated Handshake: The attacker initiates an unauthenticated VPN tunnel negotiation against the exposed firewall gateway.
  2. Malformed Sequence Delivery: A sequence of malformed packets triggers an unhandled memory exception in the ASA/FTD crypto/VPN parser daemon.
  3. Device Crash & Reload: The hardware watchdog detects process crash and triggers a complete system reload. By repeating the payload, attackers can maintain persistent denial of service.

Remediation

✅
Remediation Steps: Apply Cisco's fixed software maintenance releases immediately. If patching cannot occur immediately, disable unnecessary VPN features on public interfaces or apply rate limiting on IKEv2/SSL VPN negotiation handshakes. Monitor crash logs (show crashinfo) for recurring core dumps associated with VPN process threads.
🧭
More Deep Dives from this Week's Roundup: CVE-2026-68820: Windows AFD.sys Zero-Day (Lazarus) CVE-2026-72898: Metabase Unauth SQL Injection CVE-2026-8037: Progress Kemp LoadMaster Root RCE Swiss BIT Breach: Federal SharePoint Intrusion ← Return to Weekly Overview: Full Roundup

Read more