Cisco ASA and FTD VPN Heap Inspection Denial-of-Service Flaw
Unauthenticated remote attackers can crash Cisco Secure Firewall ASA and FTD devices over VPN. Added to CISA KEV on 2026-08-11 with a three-day federal remediation deadline.
- Vendor
- Cisco
- Product
- Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)
- CVSS
- 8.6
- EPSS (exploit probability)
- 1.0%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-20349 being exploited?
Yes. CISA added CVE-2026-20349 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.0% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-20349 timeline
- First 0dayNews coveragesame day as NVD
- Added to CISA KEVsame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-20349 is a heap inspection vulnerability in the VPN processing code shared between Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD). An unauthenticated, remote attacker can send crafted input to exploit the flaw, causing the affected device to reload unexpectedly — a full denial-of-service condition.
CISA added this CVE to the Known Exploited Vulnerabilities catalog on August 11, 2026, confirming active exploitation in the wild. The federal remediation deadline is August 14, 2026 under BOD 26-04.
Affected: Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) — check the Cisco advisory linked from the NVD record for specific affected software version ranges and corrected builds.
Action: Apply Cisco’s patched builds immediately. Internet-facing ASA and FTD devices processing untrusted VPN connections are the highest-priority exposure. Review firewall event logs for anomalous device reload events that may indicate pre-patch exploitation.
See full coverage: Cisco ASA/FTD VPN Flaw Exploited, CISA Sets Aug 14 Deadline.
Other Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2025-20362 Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability | [ MEDIUM ] | 6.5 | 86.7% | |
| CVE-2025-20333 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability | [ CRITICAL ] | 9.9 | 72.0% | |
| CVE-2024-20481 Cisco ASA and FTD Denial-of-Service Vulnerability | [ MEDIUM ] | 5.8 | 15.9% | |
| CVE-2024-20359 Cisco ASA and FTD Privilege Escalation Vulnerability | [ MEDIUM ] | 6.0 | 18.8% | |
| CVE-2024-20353 Cisco ASA and FTD Denial of Service Vulnerability | [ HIGH ] | 8.6 | 69.8% | |
| CVE-2020-3259 Cisco ASA and FTD Information Disclosure Vulnerabilityransomware use | [ HIGH ] | 7.5 | 71.5% | |
| CVE-2023-20269 Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerabilityransomware use | [ MEDIUM ] | 5.0 | 26.6% | |
| CVE-2020-3580 Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerabilityransomware use | [ MEDIUM ] | 6.1 | 85.6% |
