{"id":502,"date":"2026-08-17T12:59:28","date_gmt":"2026-08-17T07:29:28","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=502"},"modified":"2026-08-18T14:41:03","modified_gmt":"2026-08-18T09:11:03","slug":"cve-2026-20349-cisco-asa-ftd-vpn-flaw","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/cve-2026-20349-cisco-asa-ftd-vpn-flaw\/","title":{"rendered":"CVE-2026-20349: Cisco ASA and FTD VPN Flaw Exploited in the Wild"},"content":{"rendered":"

Cisco ASA and FTD administrators have another actively exploited edge-device vulnerability to address. CVE-2026-20349 is a high-severity denial-of-service (DoS) vulnerability. It affects remote-access functionality in Cisco Secure Firewall ASA and FTD software.<\/p>\n

Remote attackers can exploit the vulnerability without authentication. An attacker can send a crafted HTTP request to an affected service. The request can cause the device to reload. A successful attack can interrupt VPN connectivity and other remote-access operations.<\/p>\n

Cisco has confirmed exploitation in the wild. For everyone else, the more important point is simpler: exploitation is no longer hypothetical, there is no workaround, and affected deployments need Cisco’s fixed software.<\/p>\n

Key Facts About CVE-2026-20349<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Field<\/span><\/b>\u00a0<\/span><\/td>\nDetail<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
CVE<\/span>\u00a0<\/span><\/td>\nCVE-2026-20349<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Severity<\/span>\u00a0<\/span><\/td>\nCVSS 8.6 (High)<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Attack requirements<\/span>\u00a0<\/span><\/td>\nRemote, unauthenticated, no user interaction<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Impact<\/span>\u00a0<\/span><\/td>\nDenial of service resulting in device reload<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Remote code execution<\/span>\u00a0<\/span><\/td>\nNot reported<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Exploitation status<\/span>\u00a0<\/span><\/td>\nActive exploitation confirmed<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CISA KEV<\/span>\u00a0<\/span><\/td>\nListed<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Federal remediation deadline<\/span>\u00a0<\/span><\/td>\nAugust 14, 2026<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Workaround<\/span>\u00a0<\/span><\/td>\nNone<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Affected services<\/span>\u00a0<\/span><\/td>\nRemote Access SSL VPN, IKEv2 Remote Access VPN with client services, Zero Trust Network Access (applicable FTD configurations)<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Not affected<\/span>\u00a0<\/span><\/td>\nCisco Secure Firewall Management Center (FMC)<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

What Changed: CVE-2026-20349 Is Now an Active Exploitation Issue<\/h2>\n

The most important development around CVE-2026-20349 is Cisco’s confirmation of active exploitation. Attackers are already exploiting the vulnerability in the wild. That confirmation gives defenders a concrete prioritization signal. Organizations should no longer treat exploitation as a theoretical risk.<\/p>\n

For U.S. federal civilian executive branch agencies, the listing comes with an August 14, 2026 remediation deadline. The deadline does not apply to private-sector organizations. However, the exploitation signal remains relevant to organizations running affected Cisco infrastructure.<\/p>\n

That distinction matters. Vulnerability management teams routinely face more high-severity vulnerabilities than they can patch immediately.<\/p>\n

Several factors increase the vulnerability’s remediation priority:<\/p>\n