CVE-2026-20349 Triggers Remote DoS on Cisco ASA/FTD VPN Services After In-Wild Exploitation
CVE-2026-20349 enables remote reload of Cisco ASA and FTD devices through malformed HTTP to VPN services. Active exploitation triggered CISA KEV listing with an August 14, 2026 federal deadline. No workarounds; pattern matches prior unpatched Cisco perimeter exposures.
Federal Civilian Executive Branch agencies must now prioritize patching under binding CISA directives. Operators should audit exposed VPN interfaces immediately, given the lack of mitigations and the device's role as network perimeter choke points. Expect follow-on scanning for unpatched systems and potential chaining with other VPN flaws observed in 2025-2026 contractor reports.
CISA: At least 75 FCEB agencies will report full patch deployment on exposed ASA/FTD devices by September 30, 2026.
Sources (2)
- [1]Cisco Security Advisory(https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-dos-2026)
- [2]CISA Known Exploited Vulnerabilities Catalog(https://www.cisa.gov/known-exploited-vulnerabilities-catalog)