Cisco Says a Crafted HTTP Request Is Already Reloading ASA and FTD VPN Boxes

Cisco has confirmed that CVE-2026-20349, an insufficient error checking flaw in how Secure Firewall ASA and Secure FTD software process HTTP requests, is being exploited in the wild to knock affected devices over ^[1][2]. The company says an unauthenticated remote attacker can send a crafted HTTP request to the Remote Access SSL VPN service and cause the device to reload, producing a denial of service ^[3]. That is not a breach, but on an appliance that terminates employee remote access it is the same thing as the service being gone.

The bug carries a CVSS score of 8.6 ^[2]. Cisco says there are no workarounds ^[4], which removes the usual stopgaps: there is no ACL tweak or feature toggle offered, and the exposed service is the one your users depend on.

Exposure is determined by configuration, not just version. Cisco lists three vulnerable configurations: IKEv2 remote access VPN with client services enabled, SSL-VPN via `webvpn enable`, and Zero Trust Network Access via `zero-trust enable` ^[5]. Note the mismatch worth reading twice: the exploit path Cisco describes is a request to the Remote Access SSL VPN service ^[3], while the vulnerable configuration list is broader than SSL-VPN alone ^[5]. Treat any of those three as in scope.

Fixes exist across six ASA trains, including 9.20.4.235, 9.22.3.191, 9.23.1.211 and 9.24.1.221 ^[6][7]. On the FTD side, remediation is delivered as hotfix bundles rather than full releases, spanning six trains from 7.0 through 10.0 ^[8][9]. The presence of a 7.0 hotfix is a useful signal about who Cisco expects to be running this in production ^[8].

Provenance of the finding is mixed. Cisco says it found the issue during internal security testing and separately credited Valerio Brussani with discovering and reporting it ^[10]. Cisco became aware of active exploitation earlier in the month ^[11]. There are no published details on the attacks, the actor, who was targeted, or whether any attempts succeeded ^[12], so the only thing defenders can act on is the advisory itself.

CISA has added the flaw to its Known Exploited Vulnerabilities catalog and set a remediation deadline of August 14, 2026 for Federal Civilian Executive Branch agencies ^[13]. That deadline lands in the same month Cisco says it learned of exploitation ^[14], which is the tell for how CISA reads the risk. Non-federal operators get no deadline and the same exposure.

Practical order of work: identify appliances with any of the three configurations enabled, confirm the running train against Cisco's fixed builds and hotfixes, and schedule the reload you choose rather than the one an attacker picks for you. Because the impact is a device reload ^[3], monitoring should include unexplained restarts of internet-facing ASA and FTD units, not just failed authentication patterns.

What to watch: whether the exploitation Cisco describes turns out to be opportunistic disruption or reconnaissance ahead of something with a worse impact, given that no attack details have been published ^[12]; whether Cisco's affected configuration list expands beyond the current three ^[5]; and whether the August 14 federal deadline slips, which would suggest patch or hotfix friction in the field ^[13].