Skip to content
VulniPulse
Sign in
Advisory severityHigh8.6Cisco Exploited CISA KEV

High [CVE-2026-20349] Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability

This high-severity Cisco advisory covers CVE-2026-20349 affecting Secure Firewall Adaptive Security Appliance (ASA) Software, Firepower 2100 Series, Firepower 1000 Series.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

cisco-sa-asaftd-vpn-dos-dzv4mQFF Source published Source updated

VulniPulse record published Record updated

CVE-2026-20349
Affected products & platforms
CiscoFirewallASA / FirepowerASA 5500
Open source advisory

Android app · Google Play

Monitor future Cisco CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of September 16, 2026, Security Advisories.

In addition, for further documentation of improvements and fixes in Cisco Secure Firewall products, see Cisco Secure Firewall Adaptive Security Appliance Software, Secure Firewall Threat Defense Software, and Secure Firewall Management Center Software Hardening Release: September 2026.

Affected products named by the advisory: Firepower 2100 Series; Firepower 1000 Series; ASA 5500-X Series Firewalls; 3000 Series Industrial Security Appliances (ISA); and 3 more.

CISA Known Exploited Vulnerability

Listed:
Aug 11, 2026 · federal remediation due Aug 14, 2026
Required action:
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware use:
Unknown

KEV is a prioritization signal from CISA — remediation detail still comes from the vendor advisory.

Affected versions
  • Scope: This vulnerability affects Cisco devices if they are running a vulnerable release of Cisco Secure Firewall ASA Software or Cisco Secure FTD Software and have one or more of the vulnerable configurations listed in the following table.
  • Release 9.16 and earlier (first fixed: 9.16.4.103)
  • Release 9.18 (first fixed: 9.18.4.94)
  • Release 9.20 (first fixed: 9.20.4.49)
  • Release 9.22 (first fixed: 9.22.3.26)
  • Release 9.23 (first fixed: 9.23.1.47)
  • Release 9.24 (first fixed: 9.24.1.26)
  • Release 7.0 and earlier (first fixed: 7.0.10)
  • Release 7.2 (first fixed: 7.2.12)
  • Release 7.4 (first fixed: 7.4.8)
  • Release 7.6 (first fixed: 7.6.6)
  • Release 7.7 (first fixed: 7.7.13)
  • Release 10.0 (first fixed: 10.0.2)
  • Release 10.1 (first fixed: 10.1.0)

Official advisory · high-confidence parse· fetched 19 days ago·verify at source

Fixed versions
  • 9.16.4.103
  • 9.18.4.94
  • 9.20.4.49
  • 9.22.3.26
  • 9.23.1.47
  • 9.24.1.26
  • 7.0.10
  • 7.2.12
  • 7.4.8
  • 7.6.6
  • 7.7.13
  • 10.0.2
  • 10.1.0

Official advisory · high-confidence parse· fetched 19 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
  • Release 9.16 and earlier: upgrade to 9.16.4.103.
  • Release 9.18: upgrade to 9.18.4.94.
  • Release 9.20: upgrade to 9.20.4.49.
  • Release 9.22: upgrade to 9.22.3.26.
  • Release 9.23: upgrade to 9.23.1.47.
  • Release 9.24: upgrade to 9.24.1.26.
  • Release 7.0 and earlier: upgrade to 7.0.10.
  • Release 7.2: upgrade to 7.2.12.
Workaround status
  • There are no workarounds that address this vulnerability.

Official advisory · high-confidence parse· fetched 19 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.