Cisco firewall DoS bug is under active attack, and the federal fix deadline is August 14

Cisco has confirmed that attackers are exploiting a high-severity flaw, CVE-2026-20349, to temporarily interrupt the operation of its firewalls ^[1]. The bug is in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of August 14, 2026 for US civilian federal agencies ^[2], one day after Help Net Security reported the fixes ^[12][14].

The mechanics are as simple as this class of bug gets. A specially crafted HTTP request to the vulnerable service can cause the appliance to reload unexpectedly, producing a denial of service ^[7]. No authentication is required, and no user has to be tricked into clicking anything ^[8]. That combination means the only real precondition is reachability, and the affected service is one that organisations deliberately expose to the internet.

The exposed surface is the Remote Access SSL VPN service on Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software ^[4]. Three features carry the risk: IKEv2 Remote Access VPN with client services, SSL VPN, and Zero Trust Network Access ^[5]. An appliance is vulnerable only if it runs an affected software version and has one of those features enabled, meaning the SSL listen sockets are active ^[6]. That condition is worth reading closely, because Cisco offers no workarounds ^[10]. The only levers available are the hot fix or turning off remote access, and turning off remote access is the same outcome the attacker is trying to produce.

Cisco has issued hot fixes covering ASA versions 9.16, 9.18, 9.20, 9.22, 9.23 and 9.24, and FTD versions 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 ^[9]. That is twelve separate software trains ^[13], which tells you something about the installed base this touches: not a narrow slice of current deployments but most of the fleet anyone has been running for the past several years.

Detection is the weak spot. Cisco published no specific indicators of compromise ^[10], and details of the attacks remain undisclosed; the company said only that its Product Security Incident Response Team became aware of active exploitation in August 2026 ^[3]. In practice, the artefact available to a defender is the symptom itself, an unexplained reload of the appliance ^[7]. Anyone who has written off a mystery VPN restart in the past two weeks as a firmware hiccup should go back and look at it again.

One detail in the advisory is worth noting for how these things surface. Cisco says it found the vulnerability during internal security testing, and that it was also reported by security researcher Valerio Brussani ^[11]. An internally discovered bug still ended up in the KEV catalog within days of the fix, which is the pattern to plan around: the gap between disclosure and a federal deadline is now measured in days, not quarters.

What to watch: whether Cisco updates the advisory with exploitation detail or indicators now that hot fixes are out, and whether the same crafted-request path proves to do more than reload the box. Denial of service on a VPN head-end is the reported impact today ^[1][7], but memory-corruption bugs in this service historically get revisited. Operators should also confirm which of the three features are actually enabled on each appliance ^[5][6], because that inventory is the difference between a patch window and a fire drill.